Fix bounds checking for text properties in `format' (Bug#5306).