fix(terminal): off-by-one in terminal_set_cursor bounds check

[kudasaixc]

x == VGA_WIDTH and y == VGA_HEIGHT passed the check, so the next terminal_putentryat() could write at index row * 80 + 80 -- one cell past the end of the line, and past the end of the VGA text buffer when already on the last row.

[kudasaixc]

PoC

terminal_set_cursor clamps with > instead of >=:

if (x > VGA_WIDTH)  x = VGA_WIDTH - 1;   // 80 > 80 is false -> x stays 80
if (y > VGA_HEIGHT) y = VGA_HEIGHT - 1;  // 25 > 25 is false -> y stays 25

The ANSI H handler passes 0-based x-1, y-1, so an escape asking for column 81 / row 25 slips straight through the clamp. This is reachable from anything printed to the terminal — e.g. echo:

echo \x1b[25;81H

drives terminal_set_cursor(80, 24); x = 80 == VGA_WIDTH is not caught, so the next character is written at:

index = row * VGA_WIDTH + col = 24 * 80 + 80 = 2000

The VGA text buffer holds 80 * 25 = 2000 cells (valid indices 0–1999), so index 2000 is one past the end — an out-of-bounds write into whatever MMIO/memory follows 0xB8000. Fix uses >=.

[im-nymii]

LGTM