workspaces: don't segfault on invalid move_surface_to_workspace request

Also fixes the off-by-one in toytoolkit that exposed the issue.

clients/window.c

@@ -1704,7 +1704,7 @@ frame_menu_func(struct window *window, int index, void *data)
 		break;
 	case 3: /* move to workspace below */
 		display = window->display;
-		if (display->workspace < display->workspace_count)
+		if (display->workspace < display->workspace_count - 1)
 			workspace_manager_move_surface(display->workspace_manager,
 						       window->surface,
 						       display->workspace + 1);

src/shell.c

@@ -548,6 +548,7 @@ static struct workspace *
 get_workspace(struct desktop_shell *shell, unsigned int index)
 {
 	struct workspace **pws = shell->workspaces.array.data;
+	assert(index < shell->workspaces.num);
 	pws += index;
 	return *pws;
 }
@@ -849,6 +850,9 @@ move_surface_to_workspace(struct desktop_shell *shell,
 	if (workspace == shell->workspaces.current)
 		return;
 
+	if (workspace >= shell->workspaces.num)
+		workspace = shell->workspaces.num - 1;
+
 	from = get_current_workspace(shell);
 	to = get_workspace(shell, workspace);