Artwork fetch: release the DNS slot if its thread can't start; stricter GIF control blocks

Final review follow-up. A failed Thread.start() leaked a resolver slot (four
failures disabled artwork lookups). GIF graphic-control blocks must have the
fixed 4-byte payload (otherwise dropped) and an image with no pixel data is
rejected.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ui/apk_sources/_images.py

@@ -86,8 +86,12 @@ def _resolve(host, port, timeout):
             found['error'] = e
         finally:
             _resolvers.release()
-    worker = threading.Thread(target=run, daemon=True)
-    worker.start()
+    try:
+        worker = threading.Thread(target=run, daemon=True)
+        worker.start()
+    except BaseException:
+        _resolvers.release()  # the worker never ran, so it can't release its slot
+        raise
     worker.join(timeout)
     if 'error' in found:
         raise found['error']

ui/frame_artwork.py

@@ -56,7 +56,7 @@ def gif_frame(data):
             raise ValueError('truncated GIF')
         if data[pos] == 0x21 and pos + 1 < len(data):  # extension: keep the frame's graphic control
             end = _gif_blocks(data, pos + 2)
-            if data[pos + 1] == 0xf9:
+            if data[pos + 1] == 0xf9 and end - pos == 8 and data[pos + 2] == 4:  # GIF89a: fixed 4-byte payload
                 control = data[pos:end]
             pos = end
         elif data[pos] == 0x2c and pos + 10 <= len(data):  # the first image
@@ -70,6 +70,8 @@ def gif_frame(data):
             if pos >= len(data) or not 2 <= data[pos] <= 8:  # the LZW minimum code size
                 raise ValueError('invalid GIF image data')
             end = _gif_blocks(data, pos + 1)
+            if end - pos <= 2:  # code size then the terminator: no pixels at all
+                raise ValueError('invalid GIF image data')
             return head + control + data[start:end] + b'\x3b'
         else:
             raise ValueError('invalid GIF block')