fix: 修复 oxide_builtins 整数溢出 panic 点与安全转换

crates/oxide_builtins/src/global/annex_b.rs

@@ -76,7 +76,10 @@ fn unescape_string(input: &str) -> String {
             }
         }
 
-        let ch = input[i..].chars().next().expect("valid utf-8 char boundary");
+        let ch = match input[i..].chars().next() {
+            Some(c) => c,
+            None => break,
+        };
         out.push(ch);
         i += ch.len_utf8();
     }

crates/oxide_builtins/src/global/uri.rs

@@ -77,7 +77,10 @@ fn decode_uri_units(input: &[u16], preserve_reserved: bool) -> Result<Vec<u16>,
         }
 
         let decoded = std::str::from_utf8(&encoded).map_err(|_| ())?;
-        let ch = decoded.chars().next().expect("单字节序解出恰一个码点");
+        let ch = match decoded.chars().next() {
+            Some(c) => c,
+            None => continue,
+        };
         if preserve_reserved && ch.is_ascii() && URI_RESERVED.contains(ch) {
             out.extend_from_slice(&input[raw_start..i]);
             continue;