+ check bounds in RPN tokens, related and others (tdf#90694) [Eike Rathke] + fix Writer crash (tdf#91228) [Philippe Jung]