Fix rare aborts in bidi.c.

Fix rare aborts in bidi.c.

 src/bidi.c (bidi_resolve_neutral): After finding the next
 non-neutral character, accept NEUTRAL_ON type as well, because
 directional control characters, such as LRE and RLE, have their
 type converted to that by bidi_resolve_weak.  This avoids aborts
 when LRE/RLE follows a run of neutrals.
 (bidi_move_to_visually_next): Assert that return value of
 bidi_peek_at_next_level is non-negative.  Negative values will
 cause an infloop.