GetValue and Exists validated only the upper bound of a numeric key-path segment, so a negative index such as "arr.-1" passed the check and indexed the slice with -1, causing an index-out-of-range panic. Add a lower-bound check (i < 0) to the []int, []string and []any cases in both functions.