fix: formula correctness and command validation bugs

- model.rs: division by zero now returns Empty instead of 0 so the cell
  visually signals the error rather than silently showing a wrong value.
  Updated the test to assert Empty.
- parser.rs: missing closing ')' in aggregate functions (SUM, AVG, etc.)
  and IF(...) now returns a parse error instead of silently succeeding,
  preventing malformed formulas from evaluating with unexpected results.
- dispatch.rs: SetCell validates that every category in the coords
  exists before mutating anything; previously a typo in a category name
  silently wrote an orphaned cell (stored but never visible in any grid)
  and returned ok. Now returns an error immediately.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/formula/parser.rs

@@ -255,6 +255,8 @@ fn parse_primary(tokens: &[Token], pos: &mut usize) -> Result<Expr> {
                         // expect )
                         if *pos < tokens.len() && tokens[*pos] == Token::RParen {
                             *pos += 1;
+                        } else {
+                            return Err(anyhow!("Expected ')' to close aggregate function"));
                         }
                         return Ok(Expr::Agg(func, Box::new(inner), filter));
                     }
@@ -268,7 +270,11 @@ fn parse_primary(tokens: &[Token], pos: &mut usize) -> Result<Expr> {
                         let then = parse_add_sub(tokens, pos)?;
                         if *pos < tokens.len() && tokens[*pos] == Token::Comma { *pos += 1; }
                         let else_ = parse_add_sub(tokens, pos)?;
-                        if *pos < tokens.len() && tokens[*pos] == Token::RParen { *pos += 1; }
+                        if *pos < tokens.len() && tokens[*pos] == Token::RParen {
+                            *pos += 1;
+                        } else {
+                            return Err(anyhow!("Expected ')' to close IF(...)"));
+                        }
                         return Ok(Expr::If(Box::new(cond), Box::new(then), Box::new(else_)));
                     }
                     Ok(Expr::Ref(name))