fix(geom): reject extreme warp split indices without overflow

crates/geom/src/warp.rs

@@ -555,7 +555,7 @@ impl BezierMesh {
     /// Exact when the patches came from an unedited split; otherwise the outer control points are
     /// kept and the inner handles extrapolated.
     pub fn remove_split_u(&mut self, k: usize) -> bool {
-        if k == 0 || k + 1 >= self.us.len() {
+        if k == 0 || k >= self.us.len().saturating_sub(1) {
             return false;
         }
         let a = (self.us[k] - self.us[k - 1]) / (self.us[k + 1] - self.us[k - 1]);
@@ -1275,6 +1275,26 @@ mod tests {
         }
     }
 
+    #[test]
+    fn remove_split_u_rejects_out_of_range_indices() {
+        let original = BezierMesh::identity(B, 2, 3);
+        for k in [0, original.us.len() - 1, original.us.len(), usize::MAX - 1, usize::MAX] {
+            let mut mesh = original.clone();
+            assert!(!mesh.remove_split_u(k), "index {k}");
+            assert_eq!(mesh, original, "index {k} must leave the mesh unchanged");
+        }
+    }
+
+    #[test]
+    fn remove_split_v_rejects_out_of_range_indices() {
+        let original = BezierMesh::identity(B, 2, 3);
+        for k in [0, original.vs.len() - 1, original.vs.len(), usize::MAX - 1, usize::MAX] {
+            let mut mesh = original.clone();
+            assert!(!mesh.remove_split_v(k), "index {k}");
+            assert_eq!(mesh, original, "index {k} must leave the mesh unchanged");
+        }
+    }
+
     #[test]
     fn splits_are_exact_and_removable() {
         let mut m = BezierMesh::identity(B, 1, 1);