syntax: fix a mksh Quote edge case found by fuzzing

Our check for 16-bit runes on mksh was wrong;
we thought we could quote 0xFFFE and 0xFFFF, but we can't.

Fix that, and quote the man page properly.

syntax/quote.go

@@ -138,16 +138,17 @@ func Quote(s string, lang LangVariant) (string, error) {
 			case r > utf8.MaxRune:
 				// Not a valid Unicode code point?
 				return "", &QuoteError{ByteOffset: offs, Message: quoteErrRange}
+			case lang == LangMirBSDKorn && r > 0xFFFD:
+				// From the CAVEATS section in R59's man page:
+				//
+				// mksh currently uses OPTU-16 internally, which is the same as
+				// UTF-8 and CESU-8 with 0000..FFFD being valid codepoints.
+				return "", &QuoteError{ByteOffset: offs, Message: quoteErrMksh}
 			case r < 0x10000:
 				// \uXXXX, fixed at four hexadecimal characters.
 				fmt.Fprintf(&b, "\\u%04x", r)
 			default:
 				// \UXXXXXXXX, fixed at eight hexadecimal characters.
-				if lang == LangMirBSDKorn {
-					// mksh seems to lack support for codepoints above 16 bits?
-					// See the CAVEATS section in R59.
-					return "", &QuoteError{ByteOffset: offs, Message: quoteErrMksh}
-				}
 				fmt.Fprintf(&b, "\\U%08x", r)
 			}
 			rem = rem[size:]

syntax/testdata/fuzz/FuzzQuote/23cf0175e40438e8033b11cdd1441a2d2893a99144c4ac0f2b5f4caa113c9edd

@@ -0,0 +1,3 @@
+go test fuzz v1
+string("\uffff")
+byte('\x02')