fix: guard WASM alloc against i32 overflow for >268M row columns

safeAlloc() returns 0 (OOM) when byte size exceeds 0x7FFFFFFF,
preventing i32 truncation on the JS→WASM boundary which would
allocate a tiny buffer and cause out-of-bounds writes.
All 47 alloc call sites now go through the guard.

Author: teamchong