fix: avoid unsigned overflow in home_replace()

(cherry picked from commit d3ac297554)

test/functional/editor/tabpage_spec.lua

@@ -144,4 +144,10 @@ describe('tabpage', function()
     command('     silent      :keepalt   :: :::    silent!    -2    tabmove')
     eq(1, funcs.nvim_tabpage_get_number(0))
   end)
+
+  it(':tabs does not overflow IObuff with long path with comma #20850', function()
+    meths.buf_set_name(0, ('x'):rep(1024) .. ',' .. ('x'):rep(1024))
+    command('tabs')
+    assert_alive()
+  end)
 end)