mruby-sprintf: prevent buffer overread in named format parsing; fix #6648

add bounds check at retry label to prevent reading past end of format string
when parsing unterminated named parameters like %<foo without closing >

Co-authored-by: Claude <noreply@anthropic.com>

mrbgems/mruby-sprintf/src/sprintf.c

@@ -413,6 +413,9 @@ mrb_str_format(mrb_state *mrb, mrb_int argc, const mrb_value *argv, mrb_value fm
     nextvalue = mrb_undef_value();
 
 retry:
+    if (p >= end) {
+      mrb_raise(mrb, E_ARGUMENT_ERROR, "malformed format string - unexpected end");
+    }
     {
       fmt_spec_t spec = get_format_info(*p);