Check module icon array index in parsing escape sequences

Modules ought to be treated as potentially buggy or even malicious.

... of course it's ridiculous, given that the modules are part of the
same process and have thus as much the power to wreak havoc as karuibar
itself. But since modules are possibly being written by third-party (and
not checked by upstream karuibar), it's still a good idea to try
sanitise the API as much as possible.