Guard multi-frame reassembly against concurrent-sender interleaving

Fixed

• processExtendedFrame() now tracks the totalFrames count and next-expected frameSeq established by frame 0, and rejects any subsequent frame that doesn't match instead of blindly appending it. Extended CAN IDs carry no sender/session discriminator, so previously a second multi-frame message sharing the same msgType (e.g. two tentacles both retrying registration after a shared power event) that started before an in-progress reassembly finished could silently splice its data into the buffer - producing corrupted-but-plausible output (a dropped/garbled character) instead of a clean failure.

See #5 for details.