fix: add depth limit to formula evaluation, propagate errors

Circular or self-referencing formulas now return CellValue::Error
instead of stack overflowing. eval_expr uses Result<f64, String>
internally so errors (circular refs, div/0, missing refs) propagate
immediately through the expression tree via ?. The depth limit (16)
is checked per evaluate_depth call — normal 1-2 level chains are
unaffected.

Also adds CellValue::Error variant for displaying ERR:reason in the
grid, and handles it in format, persistence, and search.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/command/cmd.rs

@@ -806,6 +806,7 @@ impl Cmd for SearchNavigate {
                 let s = match ctx.model.evaluate_aggregated(&key, ctx.none_cats()) {
                     Some(CellValue::Number(n)) => format!("{n}"),
                     Some(CellValue::Text(t)) => t,
+                    Some(CellValue::Error(e)) => format!("ERR:{e}"),
                     None => String::new(),
                 };
                 s.to_lowercase().contains(&query)