fix out-of-bounds pixel write in do_draw_pixel

[Nashit-h]

do_draw_pixel fills a ceil(zoom) square of pixels starting at (x, y) but never clamps to frame_size, while the load/store handler only gates (x, y) against the frame using the float zoom. A crafted trace with a fractional zoom and a coordinate near the right or bottom edge passes that gate yet writes one row and column past the end of the image and anim buffers, which ASAN flags as a heap-buffer-overflow write. Clamp the fill to frame_size the same way the sibling fill_rect already does; valid-input frames render byte-for-byte identically.

Breaking changes

None.

Checklist

• Tests added or updated (not required for docs, CI config, or typo fixes)
• Documentation updated (if public API changed)
• Python bindings updated (if public API changed)
• Benchmarks are included here if the change is intended to affect performance.
• Commits include AI attribution where applicable (see Code of Conduct)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.03%. Comparing base (0354a54) to head (d4f6330).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9358      +/-   ##
==========================================
+ Coverage   69.95%   70.03%   +0.08%     
==========================================
  Files         259      259              
  Lines       79135    79135              
  Branches    19286    19286              
==========================================
+ Hits        55355    55423      +68     
+ Misses      17921    17882      -39     
+ Partials     5859     5830      -29     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.