Stop Descriptor and the back arrow doing each other's job

[oroderico]

In Extended public key, choosing Descriptor left the menu and taking the back arrow opened the descriptor. Both address types are affected.

Cause

choose_menu_at returns the arrow as the index one past the last row — the slot the Back row occupied before the arrow replaced it — so a caller checks for count. This one checked count - 1, which is the last real item, and here that item is Descriptor: the check caught it and returned, while the arrow's own value fell past every branch to the else that opens the descriptor.

It was correct when written. The menu had an explicit Back row then, so count - 1 was that row's index. Lifting Back into the arrow was meant to be transparent for callers — the arrow returns the index the row used to have, so "the checks against its old index still read the same answer" — and it is, for a caller comparing against a literal, which is what Backup, Settings and Derivation each do. This one derived its check from count, and count itself shrank by one when the row left the array, so the comparison slid off the arrow and onto the last item. Silent, because the result is still a valid index.

Scope

The other eight menu call sites were read for the same shape. None derives its exit test from count, and the two that compute their row count (browse_addresses, the type menu) still compare against the right value. This was the only one left.

Not covered

Nothing in the tree would have caught this. The self-test covers rendering and geometry, not menu dispatch, and these functions are static in seedtool_app.c and out of the simulator's reach. Adding a check that would is worth doing and is deliberately not attempted here.

Verification

Host self-test and the 51 Python tests. The dispatch itself was checked by reading every menu call site, not by walking the menu — see above for why this tree has no way to assert it.