Five self-contained fixes found while developing a companion app against InfiniSim. Each is independent — happy to split into separate PRs if you'd prefer, I've kept them together only because they're all small.

Opened as a draft for your feedback on whether these are wanted and in this shape.

1. MoveScreen: stack-buffer-overflow in the screen-slide animation

MoveScreen passes sdl_height as the flush-area height, but the on-stack color_p array only holds buffer_height = sdl_height - abs(height) valid rows. In the "up" case the pointer is also already advanced by sdl_width * abs(height), so monitor_flush reads sdl_width * abs(height) colours past the end of the array.

Found with ASan; it intermittently corrupted adjacent stack frames and crashed the simulator during ordinary app navigation. Fix passes buffer_height as the area height.

2. ble_uuid_cmp: implement it

The stub return 0 means "every UUID is equal", so any service that dispatches on the characteristic UUID matches its first characteristic for every access. Implemented for 16/32/128-bit.

3. os_mbuf_copydata / os_mbuf_append: implement them

Both were no-ops. Firmware written against the normal NimBLE idioms (os_mbuf_copydata to parse a write, os_mbuf_append to produce a read) therefore saw empty payloads and produced empty responses in the simulator only — the code works on hardware. os_mbuf_append also bounds-checks against a capacity the fake-mbuf creator supplies, so an over-long append is rejected rather than overrunning the caller's buffer.

4. SpiNorFlash: fail loudly on access while asleep

On hardware the flash is in deep power-down after Sleep(): reads return garbage, writes are dropped. The simulator served correct data regardless, which hides missing-wakeup bugs that only appear on a real watch. Now aborts with the offending operation. (abort() rather than an exception because the caller is often littlefs C code, which exceptions must not unwind.)

5. -funsigned-char

The firmware targets ARM, where plain char is unsigned; x86 makes it signed. Firmware code that stores byte values in a char — or compares one against a value above 127 — behaves differently in the simulator than on the watch. This makes the sim match the target.

Testing. Builds clean against the vendored InfiniTime submodule and runs. Fixes 1–4 were each found by an actual failure (1 by AddressSanitizer, 2–3 by services silently misbehaving only under the simulator, 4 by flash corruption that reproduced only on hardware).

Relationship to my other PRs. Independent of #198 and #199. It touches CMakeLists.txt, as #198 does, but in a different place (compile options vs. the source list), so they shouldn't conflict.