Merge branch 'safer' into blead

Merge branch 'safer' into blead

I undertook an audit to see where there might be places where malformed
UTF-8 input could cause us to exceed the boundaries of buffers.  I
looked for where hopping to other characters in the string and skipping
to the next character based on the current start byte.

This branch is the result of that.  Wherever I didn't see how exceeding
the bounds wasn't a problem, I changed to use the safer versions of the
hop and skip operations that we already have.  As an example of where it
isn't a problem is when doing the operation is at the end of a loop
iteration, and the loop tests if we've exceeded it, with the result that
the loop just stops executing.

I may have missed things, and  may have changed to unnecessarily use the
safer operations in places