chore: escape every value the views write as markup, and cut symbols on code points (closes #329)

The token screen's decimals and holder count, the ETH price, every address
total and each balance row's USD value went into innerHTML unescaped, against
the rule at the top of src/popup/views/helpers.js. They are escaped now. None
could carry markup, but formatUsd() writes a value under a cent as "< $0.01".

displaySymbol() counts a symbol in code points, not UTF-16 units, so the cut
never leaves half of an emoji, which rendered as U+FFFD.

explorerLink() was already removed on next.

Model: opus-5-5

src/shared/symbolDisplay.js

@@ -20,6 +20,10 @@
 // (MSYRUPUSDP), so nothing the wallet ships as a real token is ever
 // truncated. The ellipsis is what tells the user the name they are looking
 // at is not the whole name — worth knowing before they send to it.
+//
+// Characters are counted as code points, not UTF-16 units, so an emoji is
+// one character and the cut never falls between the two halves of one: a
+// half on its own renders as U+FFFD.
 
 const MAX_SYMBOL_LENGTH = 12;
 
@@ -32,8 +36,9 @@ const UNKNOWN_SYMBOL = "???";
 function displaySymbol(symbol) {
     const s = symbol === null || symbol === undefined ? "" : String(symbol);
     if (s.length === 0) return UNKNOWN_SYMBOL;
-    if (s.length <= MAX_SYMBOL_LENGTH) return s;
-    return s.slice(0, MAX_SYMBOL_LENGTH - 1) + "…";
+    const chars = Array.from(s);
+    if (chars.length <= MAX_SYMBOL_LENGTH) return s;
+    return chars.slice(0, MAX_SYMBOL_LENGTH - 1).join("") + "…";
 }
 
 module.exports = {