F-37: WiThrottle throttle updates unvalidated #40

Severity: LOW · Effort: Small · Batch: 5 · Status: Code done in #21 (29b54d2), awaiting bench verification

Found in the second full review of the firmware. Recorded with the rest of the pass (F-19…F-44) in docs/REVIEW_REMEDIATION_PLAN_2.md, which is where its status is kept.

• M…A updates are applied without checking the address against the throttle's current loco,
  so a late reply for the previous loco can set the wrong baseline.
• Function numbers from the server are unbounded, so Throttle::setFunctionState and the
  function panel grow without limit.

Acceptance Criteria

• ThrottleController applies a transport report only if it names the loco the
  throttle holds (address 0 meaning "not said"). The check sits in the controller, so it
  covers both transports.
• Speeds above 126 and function numbers above 28 are dropped.
• Unit tests test_controller_ignores_update_for_other_loco and
  test_controller_bounds_reported_speed_and_function pass on the board (they compile).