fix(l1): wrap-safe UI timers, a failed send keeps the text, bars stop at the ends

- The redraw, alert, splash and sensor timers compare millis() wrap-safe
  (refreshDue(), alertShowing(); 0 = now / none), so the screen keeps
  refreshing past the 49.7-day rollover.
- A failed send leaves the keyboard with its text ("Not sent" in the field
  label, as alerts don't show over it) or the quick-message list with
  "Send failed", instead of dropping to Home. No "Sent" echo.
- The dashboard's Sats field shows "--" with the GPS off, not a stale count.
- Brightness and volume in Settings stop at both ends instead of wrapping.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

examples/companion_radio/ui-new/UITask.h

@@ -344,6 +344,10 @@ public:
   void wakeForAlarm();
   // Clear any active alert overlay early (alarm dismiss).
   void clearAlert() { _alert_expiry = 0; }
+  // Wrap-safe (millis() rolls over after ~49.7 days). _next_refresh 0 = draw
+  // on the next pass; _alert_expiry 0 = no alert.
+  bool refreshDue() const { return !_next_refresh || (int32_t)(millis() - _next_refresh) >= 0; }
+  bool alertShowing() const { return _alert_expiry && (int32_t)(_alert_expiry - millis()) > 0; }
   // Clock tools engine API (ui-core/ClockEngine.h) — ClockToolsScreen drives
   // these; the engine runs from tickCore() so it fires regardless of the screen.
   void onAlarmChanged();