ui/curses: always use "%s"-style format for printf()-style functions

ui/curses: always use "%s"-style format for printf()-style functions

`ncuses-6.3` added printf-style function attributes and now makes
it easier to catch cases when user input is used in palce of format
string when built with CFLAGS=-Werror=format-security:

  ui/curses.c:765:42:
    error: format not a string literal and no format arguments [-Werror=format-security]
    765 |         mvprintw(rowstat - 1, startstat, msg);
        |                                          ^~~

Let's wrap all the missing places with "%s" format.