Fix menu navigation: restore original up/down behavior

- Keep loop counters in FindNextItem/FindPrevItem (prevents infinite recursion)
- Restore FindNextDownItem/FindNextUpItem to original logic:
  - Move ONE row, then delegate to FindNextItem if slot empty
- Fix boundary check in FindNextUpItem: use BEQ/BPL for signed comparison
  (CMP #$01 : BCS was wrong - unsigned comparison treats $FE as 254 >= 1)

The original design: Up/Down navigate rows, delegate to horizontal scan
if target slot is empty. The loop counters in horizontal navigation
prevent infinite loops when all items are empty.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Menu/menu_select_item.asm

@@ -83,14 +83,22 @@ Menu_ItemCursorPositions:
 
 Menu_FindNextItem:
 {
+  PHX                        ; Save X for counter
+  LDX.b #$18                 ; Max 24 items
+  .loop
     LDY.w $0202 : INY
     CPY.b #$19 : BCC .no_reset
       LDY.b #$01
     .no_reset
     STY.w $0202
+    PHX
     LDX.w Menu_AddressIndex-1, Y
     LDA.l $7EF300, X
-  BEQ   Menu_FindNextItem
+    PLX
+    BNE .found               ; Item exists, done
+    DEX : BNE .loop          ; Keep searching
+  .found
+  PLX
   RTS
 }
 
@@ -98,13 +106,21 @@ Menu_FindNextItem:
 
 Menu_FindPrevItem:
 {
+  PHX                        ; Save X for counter
+  LDX.b #$18                 ; Max 24 items
+  .loop
     LDY.w $0202 : DEY : BNE .no_reset
       LDY.b #$18
     .no_reset
     STY.w $0202
+    PHX
     LDX.w Menu_AddressIndex-1, Y
     LDA.l $7EF300, X
-  BEQ   Menu_FindPrevItem
+    PLX
+    BNE .found               ; Item exists, done
+    DEX : BNE .loop          ; Keep searching
+  .found
+  PLX
   RTS
 }
 
@@ -119,7 +135,7 @@ Menu_FindNextDownItem:
   TAY : STY.w $0202
   LDX.w Menu_AddressIndex-1, Y
   LDA.l $7EF300, X
-  BEQ   Menu_FindNextItem
+  BEQ Menu_FindNextItem          ; If empty, scan horizontally (now safe)
   RTS
 }
 
@@ -128,21 +144,15 @@ Menu_FindNextDownItem:
 Menu_FindNextUpItem:
 {
   LDA.w $0202 : SEC : SBC.b #$06
-  BPL   .no_reset : BNE .no_reset
-    CLC : ADC.b #$18
+  BEQ .wrap                       ; If zero, wrap
+  BPL .no_reset                   ; If positive (1+), valid
+  .wrap
+    CLC : ADC.b #$18              ; Wrap to bottom row
   .no_reset
   TAY : STY.w $0202
-  CPY.b #$19 : BCS .reset_up
   LDX.w Menu_AddressIndex-1, Y
   LDA.l $7EF300, X
-    BEQ   Menu_FindNextItem
-    RTS
-  .reset_up
-  LDY.b #$01
-  STY.w $0202
-  LDX.w Menu_AddressIndex-1, Y
-  LDA.l $7EF300,             X
-  BEQ   Menu_FindNextItem
+  BEQ Menu_FindNextItem          ; If empty, scan horizontally (now safe)
   RTS
 }