The toggle handler's limit guard indexed the unfiltered options slice
with the cursor, but the cursor tracks the filtered slice. When a filter
was applied the two indices diverged, so the guard inspected the wrong
option's selected state and allowed toggling past the configured Limit.
Index the option that is actually being toggled instead, and add a
regression test that selects up to the limit, filters, then verifies a
further toggle is a no-op.
dualfroz
upstream