forward-char: fix buffer overflow

Fixes 701c5da823 (forward-char: respect fish_cursor_end_mode again,
2026-01-12).

Fixes #12325

src/reader/reader.rs

@@ -3607,8 +3607,11 @@ fn handle_readline_command(&mut self, c: ReadlineCmd) {
                         true,
                     );
                     if !is_kill {
-                        let pos = self.edit_line(elt).position();
-                        self.update_buff_pos(elt, Some(pos + 1));
+                        let el = self.edit_line(elt);
+                        let pos = el.position();
+                        if pos < el.len() {
+                            self.update_buff_pos(elt, Some(pos + 1));
+                        }
                     }
                 }
             }