fix: correct numpy indexing in denormalize_boxes and add ultralytics validation

[jackiehimel]

Description

This PR fixes two separate bugs in the supervision library that cause crashes in production:

Bug 1: denormalize_boxes numpy indexing error
The denormalize_boxes function used incorrect numpy indexing (result[[0, 2]]) which selects rows 0 and 2 instead of all rows at columns 0 and 2. This causes an IndexError when processing more than 2 bounding boxes. The fix changes it to result[:, [0, 2]] to properly index all rows at specific columns, matching the pattern already used in clip_boxes and pad_boxes.

Bug 2: from_ultralytics missing attribute validation
The from_ultralytics method crashed with AttributeError when the results object doesn't have a boxes attribute. The code checked if boxes is None but didn't verify the attribute exists first using hasattr(). The fix adds proper hasattr() validation and returns an empty detection when the attribute is missing, following the same pattern used for obb validation.

No new dependencies required for this change.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

How has this change been tested, please provide a testcase or example of how you tested the change?

For denormalize_boxes:
Added 8 parametrized test cases covering empty arrays, single/multiple boxes, custom normalization factors, and edge cases. The tests verify the function works correctly with 3+ boxes (regression test for #1959).

For from_ultralytics:
Added 3 test cases using mock Ultralytics results to test: missing boxes attribute entirely, boxes=None (segmentation models), and valid boxes. Tests verify the function handles all cases without crashing.

All tests pass: 27 total (16 existing + 11 new).

Any specific deployment considerations

None - these are bug fixes that make the functions work as documented without changing behavior for valid inputs.

Docs

• Docs updated? What were the changes: No changes needed - both functions already have proper docstrings

Fixes #1959
Fixes #2000

[CLAassistant]

All committers have signed the CLA.

[SkalskiP]

Hi @jackiehimel! Thanks a lot for your interest in supervision and for taking the time to fix those two bugs. Since I plan to release supervision-0.27.0 today, I made a few adjustments to your proposed code.

I removed the from_ultralytics test. It depends on code outside the project, and I do not want to maintain mock classes that imitate objects returned by ultralytics. Being able to parse the output correctly is enough.

I fixed from_google_gemini_2_0, from_google_gemini_2_5 and from_moondream, which broke after changes in denormalize_boxes.