Show the .notdef glyph if a char was not found.
Prefer the CMAP encoding to the CFF encoding.

In my experience, the CFF encoding in OpenType fonts is often just a
dummy encoding (often set to the predefined standard encoding), whereas
the CMAP encoding contains the full range of characters.