Fix 4 bugs found in code review

- BotScreen keyboard: add explicit null-terminator after strncpy when
  trigger/reply text reaches max length (strncpy skips it in that case)
- BotScreen keyboard: clamp _kb_col to 3 when moving DOWN to special row,
  so the cursor doesn't become invisible (col > 3 has no special-row item)
- MyMesh: initialise _bot_last_reply_ms = 0 in constructor (was relying on
  BSS zero-init, which is technically UB for a non-trivial class member)
- RingtoneEditor: exit via CANCEL/Save/Discard goes to ToolsScreen instead
  of HomeScreen — consistent with BotScreen and expected navigation flow

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

examples/companion_radio/MyMesh.cpp

@@ -871,6 +871,7 @@ MyMesh::MyMesh(mesh::Radio &radio, mesh::RNG &rng, mesh::RTCClock &rtc, SimpleMe
   _cli_rescue = false;
   offline_queue_len = 0;
   app_target_ver = 0;
+  _bot_last_reply_ms = 0;
   clearPendingReqs();
   next_ack_idx = 0;
   sign_data = NULL;