fix(companion): null-guard geo-alert picker, clamp loc-share channel idx on load

GeoAlertScreen::openPicker() is reachable directly from handleInput()'s
Target row, bypassing the _prefs null-check every other path in this
screen goes through via activate(). DataStore's loc_share_channel_idx
was the only loc_share_* field without a clamp-on-load, unlike its
sibling index fields (harmless today since getChannel() bounds-checks
it, but inconsistent with the established defensive pattern).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

examples/companion_radio/ui-new/GeoAlertScreen.h

@@ -211,6 +211,7 @@ public:
   }
 
   void openPicker() {
+    if (!_prefs) return;
     buildTargets();
     if (_target_n == 0) { _task->showAlert("No favs / waypoints", 1400); return; }
     int cur = currentTargetIndex();