fix: CI-V frames read at the wrong offset decoded as plausible frequencies

From F4JND's log: a rig sitting on 145.550 MHz FM produced status lines reading
16445550000, 8364550000, 5817408364 and 12640 Hz between good readings — the last
of those even resolved to a 6 cm band.

BCDToFreq treated the nibbles 0x0A..0x0F as the digits 10..15, so a byte stream
that had lost frame sync still decoded into a number. The same log shows why sync
was lost: PTT round trips timing out and a scope stream the rig kept rejecting
(0x27), both competing with the poll on one serial line.

Non-decimal nibbles are now refused. Each caller keeps its last good value rather
than publishing noise: the frequency reader returns an error, the sub-VFO reader
returns not-ok, and the scope keeps its previous edges. Garbage that LOOKS like a
frequency is worse than a refused frame — it reaches the display, the band slots
and eventually the log, and it is the operator who then has to disprove it.

The test builds its fixture with FreqToBCD rather than by hand, because my
hand-written one was byte-reversed and the test caught it.

This does NOT explain the white screen that was also reported, and I have not
claimed it does: it removes one source of absurd values reaching the UI, which is
worth doing on its own evidence.

internal/cat/civ/civ_test.go

@@ -12,8 +12,9 @@ func TestFreqBCDRoundTrip(t *testing.T) {
 		if len(b) != 5 {
 			t.Fatalf("FreqToBCD(%d) len=%d, want 5", hz, len(b))
 		}
-		if got := BCDToFreq(b); got != hz {
-			t.Errorf("round trip %d → % X → %d", hz, b, got)
+		got, ok := BCDToFreq(b)
+		if !ok || got != hz {
+			t.Errorf("round trip %d → % X → %d (ok=%v)", hz, b, got, ok)
 		}
 	}
 }
@@ -49,8 +50,8 @@ func TestScanSingleFreqResponse(t *testing.T) {
 	if f.From != 0x98 || f.To != AddrController || f.Cmd != CmdReadFreq {
 		t.Errorf("addrs/cmd wrong: %+v", f)
 	}
-	if hz := BCDToFreq(f.Data); hz != 14250000 {
-		t.Errorf("decoded freq %d, want 14250000", hz)
+	if hz, ok := BCDToFreq(f.Data); !ok || hz != 14250000 {
+		t.Errorf("decoded freq %d (ok=%v), want 14250000", hz, ok)
 	}
 }
 
@@ -163,3 +164,43 @@ func TestModelNameAddresses(t *testing.T) {
 		t.Errorf("ModelName(0x42) = %q, want the hex fallback", got)
 	}
 }
+
+// A frame that is not decimal BCD is refused rather than decoded.
+//
+// From an operator's log (F4JND, 2026-07-30): a rig sitting on 145.550 MHz FM
+// produced status lines reading 16445550000, 8364550000, 5817408364 and 12640 Hz
+// between good readings. CI-V had lost frame sync — a reply read at the wrong
+// offset, alongside PTT timeouts and a scope stream the rig was rejecting — and
+// the decoder treated the nibbles 0x0A..0x0F as the digits 10..15, turning noise
+// into a plausible-looking number.
+//
+// Garbage that looks like a frequency is worse than a refused frame: it reaches
+// the status bar, the band slots and the log, and it is what an operator then
+// has to disprove.
+func TestBCDToFreqRejectsNonDecimal(t *testing.T) {
+	// Valid: 145.550 MHz, encoded by the same package rather than by hand — my
+	// hand-written fixture was byte-reversed and this caught it.
+	good := FreqToBCD(145550000)
+	if hz, ok := BCDToFreq(good); !ok || hz != 145550000 {
+		t.Errorf("valid BCD % X decoded as %d (ok=%v), want 145550000", good, hz, ok)
+	}
+
+	// Every nibble value above 9 must be refused, in either half of the byte.
+	bad := [][]byte{
+		{0x0A, 0x00, 0x55, 0x45, 0x01}, // low nibble
+		{0x00, 0x00, 0xF5, 0x45, 0x01}, // high nibble
+		{0xFF, 0xFF, 0xFF, 0xFF, 0xFF}, // an idle line read as data
+		{0x00, 0x00, 0x00, 0x0B, 0x00},
+	}
+	for _, b := range bad {
+		if hz, ok := BCDToFreq(b); ok {
+			t.Errorf("% X was accepted as %d Hz — it is not decimal BCD", b, hz)
+		}
+	}
+
+	// A short frame still decodes what it holds: the caller decides whether a
+	// partial read is usable, and refusing it here would break the 4-byte forms.
+	if _, ok := BCDToFreq([]byte{0x00, 0x50}); !ok {
+		t.Error("a short but valid BCD frame must still decode")
+	}
+}