strip terminal control sequences from server-supplied text

Remove control, DEL, and bidi characters before display.
HTML escaping was the only filter, which leaves ANSI and OSC escape
sequences intact. A remote user could move the cursor, recolour the
screen, or reorder what was shown by putting escape codes in a
message, a nickname, or a channel name. Names rendered in the channel
tree go through the same filter now.

Keep the text box cursor and the prompt on rune boundaries.
Both indexed by byte, so editing a line containing multi-byte
characters could split one and render replacement characters.

Handle text view lines that carry no timestamp.
Toggling timestamps assumed every stored line had one and sliced past
the end of lines that did not.

Ignore key events on an empty tree.
The handlers indexed the item list before checking that it had any
items.

Remove the beep helpers.
They shelled out to an optional "beep" binary and panicked when it was
absent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

uiterm/textview.go

@@ -84,8 +84,11 @@ func (t *Textview) updateParsedLines() {
 	parsed := make([]string, 0, len(t.Lines))
 	for _, line := range t.Lines {
 		var l = line
-		if t.showTimestamps == false {
-			l = strings.TrimSpace(strings.Split(line, "]")[1])
+		if !t.showTimestamps {
+			// Server and local messages need not have a timestamp prefix.
+			if _, text, ok := strings.Cut(line, "]"); ok {
+				l = strings.TrimSpace(text)
+			}
 		}
 		current := ""
 		chars := 0
@@ -143,7 +146,7 @@ func (t *Textview) uiDraw() {
 			var chr rune = ' '
 			if reader != nil {
 				if ch, _, err := reader.ReadRune(); err == nil {
-					chr = ch
+					chr = safeRune(ch)
 				} //no err
 			} //reader != nil
 			termbox.SetCell(x, y, chr, termbox.Attribute(t.Fg), termbox.Attribute(t.Bg))