Bail ASI loop when inner expr() does not advance the cursor

[davejcameron]

A switch body with multi-statement case branches throws RangeError: Invalid array length while parsing:

parse(`switch (x) {
  case 1:
    a
    b
  case 2:
    c
}`)

Trace: infinite recursion through asi → expr → asi → expr … until the semicolon-list array overflows. The ASI loop continues whenever the inner expr() returns truthy, but a lookup handler is allowed to return a non-array sentinel to mean "matched but did not consume" — feature/switch.js's reserve('case') does this when case/default appears inside a switch body, so ASI re-enters at the same cursor position.

Bail when the recursive expr() returns truthy without advancing idx. Regression test in test/feature/control.js. Suite stays green (294/294).