fix(text): refuse an atlas that would overflow its own arithmetic, and clamp the cell before narrowing it

include/plot/text/true_type_font.hpp

@@ -104,6 +104,11 @@ class TrueTypeFont final : public render::TextBackend {
   /// cell: the draw then falls back to the box, which is visible, where a blank
   /// cell would silently render nothing.
   ///
+  /// A re-bake *replaces* the glyph table, so the pointers `glyph()` handed out
+  /// before it must not be held across it -- the same rule as `from_file()` on
+  /// this object, and the reason `set_text_backend()` is how a swap is meant to
+  /// be announced rather than a long-lived pointer kept somewhere.
+  ///
   /// A re-bake that produces no ink leaves the previous atlas in place -- there
   /// is no return value to report through, and losing a working font to a bad
   /// argument is worse than ignoring it. On a backend with no face this does