[BUG] Crash on ellipsis indexing with too many trailing indices #4398

Describe the bug

Indexing an array with an ellipsis followed by more non-None indices than the array has dimensions crashes instead of raising a ValueError. mlx_expand_ellipsis in python/src/indexing.cpp computes the ellipsis-expansion loop bound as shape.size() - non_none_indices_after, where shape.size() is unsigned. When non_none_indices_after > shape.size(), this underflows, producing a huge loop bound and an out-of-bounds read / crash.

To Reproduce

import mlx.core as mx
a = mx.array([1, 2, 3])
a[..., 0, 0]  # crashes instead of raising ValueError

Expected behavior
Should raise ValueError (too many indices for array), matching NumPy's behavior, instead of crashing.

Fix
Fix + regression test up in #4396.