When a 32-bit offset entry has its MSB set, the lower 31 bits index
into the `Offset64` table. Neither `MemoryIndex.getOffset` nor
`LazyIndex.offset` validated that the resulting position fell inside
the decoded table; an idx with an MSB-set entry whose lower bits
exceed the number of decoded 64-bit entries would index past the
end of the table.

Bounds-check both lookups against the decoded table size and return
`ErrMalformedIdxFile` when the index is out of range. `MemoryIndex`'s
unexported `getOffset` now returns `(uint64, error)`; the change
propagates through `FindOffset`, `genOffsetHash`, and the `Entries`
iterator. `LazyIndex` caches the 64-bit-entry count discovered during
`init` and uses it for the same check before issuing the `ReadAt`.

Assisted-by: Claude Opus 4.7
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

`FuzzLazyIndex` covers one of the two parallel idx implementations.
The companion `MemoryIndex` (decoder + post-decode `Index` methods +
both iterators) had no fuzz coverage, which is why the offset64
bounds gap fixed in e429f8e was not surfaced earlier.

`FuzzMemoryIndex` mirrors the structure of `FuzzLazyIndex`: seed the
corpus with structurally valid prefixes (using `buildMinimalIdx`),
the empty input, and a malformed-but-decodable idx from
`buildOOBOffset64Idx`; the fuzz function then runs `Decode` and
exercises every `Index` method plus both iterators on inputs that
decode successfully.

`buildOOBOffset64Idx` lives in `fuzz_helpers.go` (alongside
`buildMinimalIdx`) rather than `_test.go`, because the OSS-Fuzz
harness extracts fuzz targets into a non-test build context where
sibling `_test.go` symbols are not resolved.

A 30s local run produced ~2.25M executions and 99 corpus inputs
without failure on top of the validated tree.

Assisted-by: Claude Opus 4.7
Signed-off-by: Hidde Beydals <hidde@hhh.computer>

The previous bounds check `offset+8 > uint64(len(idx.Offset64))`
was correct because masking and the `uint32` source type bound
`offset` to ~2^34, leaving uint64 headroom. That safety relies on
invariants in surrounding code (mask shape and source type) that
aren't visible at the comparison itself.

Reformulate as `len < 8 || offset > len-8`, which holds without
relying on the upstream bound. Behaviour is unchanged.

`LazyIndex.offset` already uses an index-vs-count comparison
(`loIndex >= s.count64`) with no addition, so it needs no
analogous change.

Assisted-by: Claude Opus 4.7
Signed-off-by: Hidde Beydals <hidde@hhh.computer>