TextBox: Fix a crash in insertText().