fix: Bound EIP-712 path_update on recursive/cyclic custom types

path_update() walks nested TYPE_CUSTOM fields and allocates a fresh
keccak hash context on every step via push_new_hash_depth(). When the
descent reached MAX_PATH_DEPTH, path_depth_list_push() returned false
but its return value was ignored, so the next iteration kept
descending and kept calling push_new_hash_depth(). For a self-referential
or cyclic schema (A { A a; } or A -> B -> A), this turned into an
unbounded allocation loop until the app's heap was exhausted, denying
service to typed-message signing.

Propagate the path_depth_list_push() failure: when the path stack is
full, abort the descent with SWO_INCORRECT_DATA. The depth cap bounds
the loop for any recursive schema while leaving legitimate nested
non-recursive types unaffected.

(cherry picked from commit d09e17100ab6b67af9161d6ff734fd0cd39aab3a)