fix(input): sanitize incoming text, balance the draw stack (A2, A3)

[Vadim1987]

Invalid UTF-8 reaching the input model makes string.ulen return nil, and the model does unguarded arithmetic on that in several places: a multi-line paste crashes at userInputModel.lua:120, set_text with a string at :475, and with a table at :730 (ulen(...) + 1 in each case). A single-line paste is worse in a way — it doesn't crash, it silently plants the invalid bytes into entered, after which the render loop hits its ulen check every frame and bails out early between push('all') and pop, leaking one graphics stack level per frame.
Two changes:

1. sanitize text at the model's entry points (add_text, both branches of set_text): drop bytes that don't form valid UTF-8, using utf8.len's error position to cut them out. Invalid bytes can arrive through the clipboard (paste in userInputController) or through the project-facing input API. Sanitizing at the boundary keeps the invariant "entered never holds invalid bytes", which covers every ulen arithmetic site in the model at once — there are more of them than the three that crash today.
2. balance the graphics stack in the view's early return, so the draw scope is exception-safe regardless of content.
   One call worth surfacing: invalid bytes are dropped, not replaced with U+FFFD. A visible replacement character would land inside source code and produce a compile error that's hard to explain to a child, and rejecting the whole paste over one bad byte felt harsher than losing it. If visible markers are preferred, it's a one-line change in the sanitizer.

[aldum]

These are two completely orthogonal fixes, please split out the stack balance fix to it's own.

[aldum]

^

[Vadim1987]

Split in two per review flow: #43 (draw stack) and #44 (UTF-8 sanitizing). No code changes vs. this PR; the sanitizing half is rebased onto current dev.

[aldum]

Superseded #43, #44