reject an out-of-range tunnelled audio length

The length is taken from the packet and only checked against the upper
bound, so a negative value passed the check and then panicked on the slice
expression that follows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

gumble/gumble/handlers.go

@@ -184,8 +184,10 @@ func (c *Client) handleUDPTunnel(buffer []byte) error {
 	log.Info("handleUDPTunnel: %s session=%d seq=%d audio_len=%d final=%v buf_remain=%d",
 		user.Name, session, seq, audioLength, isFinal, len(buffer))
 
-	if audioLength > len(buffer) {
-		log.Warn("handleUDPTunnel: audio length %d > remaining buffer %d",
+	// A negative length would pass the upper bound check below and then panic
+	// on the slice expression.
+	if audioLength < 0 || audioLength > len(buffer) {
+		log.Warn("handleUDPTunnel: audio length %d out of range for buffer %d",
 			audioLength, len(buffer))
 		return errInvalidProtobuf
 	}