reject invalid float indices before conversion

[Boulea7]

What this changes

Embedding::forward and Batch::labels now reject negative, non-finite, fractional, and out-of-range float IDs before converting them to usize. Both use the same small helper, and the panic names the invalid value; valid IDs, including negative zero, keep their existing behavior.

Why

The previous cast silently turned -1 and NaN into index 0 and truncated fractional IDs. Fixes #46.

How it was verified

The six public-API regressions produced four passes and two failures on the unchanged base, then all six passed with the fix. They cover both consumers, the offending value in the panic, valid IDs, and the usize boundary.

• cargo test --locked --offline passes
• cargo clippy --locked --offline --all-targets -- -D warnings is clean
• cargo fmt --check passes
• No GPU here, CUDA side not runtime tested

Run on Linux with Rust 1.99. MSRV 1.87, release mode, and other operating systems were not run locally.

Checklist

• Public items have /// docs
• No backward rule, kernel, or public API was added.