Validate TocEntry.spineIndex bounds before TOC navigation

Summary

Validate the upper bound of TocEntry.spineIndex before consumer code uses it.

Rationale

Current consumer checks distinguish -1 from a present index, but they do not reject indices that exceed the current spine-item count. Corrupt or stale cache data can therefore pass the sentinel check and reach a consumer with an invalid index.

Epub::getSpineItem() performs a bounds check at its use point. Add explicit validation at the affected consumer paths so the invalid state is handled consistently and safely.

Affected areas

• lib/Epub/EpubReaderActivity.cpp
• lib/Epub/EpubReaderChapterSelectionActivity.cpp
• TocEntry.spineIndex consumers and related TOC navigation logic

Required changes

• Keep the existing -1 sentinel handling.
• Before use, verify that a non-negative TocEntry.spineIndex is less than the available spine-item count.
• Handle an out-of-range value safely. Do not select or navigate to an invalid spine item.
• Add or update focused coverage if the repository test structure supports it.

Acceptance criteria

• A TocEntry.spineIndex value of -1 keeps its defined behavior.
• A valid index in the current spine range keeps existing navigation behavior.
• An index greater than or equal to the spine-item count is rejected without invalid access or navigation.

Backlinks

• Reported during PR #3452: https://github.com/crosspoint-reader/crosspoint-reader/pull/3452
• Source discussion: https://github.com/crosspoint-reader/crosspoint-reader/pull/3452#discussion_r3959528922
• Requested by @YuunJiee.