MathCAT panics on malformed MathML inputs during navigation

[venkatesh6114]

Local fuzz testing discovered two inputs that crash MathCAT with panics during do_navigate_command.

Branch used: no_unsafe-v2 branch

Crash 1: navigate.rs:572 — unwrap on empty navigation stack

Input (97 bytes — element with embedded null/garbage bytes):

Crash 2: xpath_functions.rs:1100 — assertion failure on empty children

Input (14 bytes):

<mprescripts/>

Reproduction

.\fuzz_target_1.exe fuzz\artifacts\fuzz_target_1\crash-9c4b4a5b511a92b7c5f4842091ca11189a39a050.txt
.\fuzz_target_1.exe fuzz\artifacts\fuzz_target_1\crash-7ecffdd636b416fc93312e63c88a23533a08d5d1.txt

crash-9c4b4a5b511a92b7c5f4842091ca11189a39a050.txt
crash-7ecffdd636b416fc93312e63c88a23533a08d5d1.txt
Newly added - crash-6d33000af57ec9c4ce8bb8a4823d54e45f383b09.txt