fix(input): sanitize incoming text against invalid UTF-8 (A3)

[Vadim1987]

Invalid UTF-8 reaching the input model makes string.ulen return nil, and the model does unguarded arithmetic on that in several places: a multi-line paste crashes at userInputModel.lua:120, set_text with a string at :475, and with a table at :730 (ulen(...) + 1 in each case). A single-line paste doesn't crash — it silently plants the invalid bytes into entered, which is what makes the render loop bail out early every frame (see the companion draw-stack PR).
The fix sanitizes text at the model's entry points (add_text, both branches of set_text): bytes that don't form valid UTF-8 are dropped, using utf8.len's error position to cut them out. Invalid bytes can arrive through the clipboard (paste in userInputController) or through the project-facing input API. Sanitizing at the boundary keeps the invariant "entered never holds invalid bytes", which covers every ulen arithmetic site in the model at once — there are more of them than the three that crash today.
One call worth surfacing: invalid bytes are dropped, not replaced with U+FFFD. A visible replacement character would land inside source code and produce a compile error that's hard to explain to a child, and rejecting the whole paste over one bad byte felt harsher than losing it. If visible markers are preferred, it's a one-line change in the sanitizer.
Companion to the draw-stack fix: with the boundary invariant in place, the view's nil-ulen branch becomes unreachable in practice; the other PR makes it safe even if reached.