reject surrogate code points in \U unicode escapes

[netliomax25-code]

1. _peek_unicode detects surrogates from the first two hex digits, which only matches the 4-digit \u form.
2. The 8-digit \U form reaches the surrogate range with leading zeros (\U0000D800), so the check is skipped and the escape is accepted as a lone surrogate that fails UTF-8 encoding.
3. Test the decoded code point against U+D800..U+DFFF instead, so both forms are rejected with InvalidUnicodeValueError.

Valid boundaries (U+D7FF, U+E000) and astral code points still parse; added a regression test.