more: fix out-of-bounds write in get_line() on invalid multibyte input
In get_line(), the invalid-multibyte switch arm (case (size_t)-1) writes
*p++ = mbc[0] without the bounds check that its sibling write paths use,
and the "goto process_mbc" back-edge lets it re-run within one loop
iteration, bypassing the loop-head guard. A line that first fills line_buf
with zero-width combining characters (which advance p but not column) and
then supplies an invalid multibyte sequence can step p past the
num_columns*4 + 2 byte allocation -- a heap out-of-bounds write.
Guard the write the same way the sibling path does.