fn sanitize(s: &str) -> String
Keep printable ASCII (0x20..0x7E); replace anything else with ‘?’. The splash font only carries ASCII, so this keeps the footer legible for odd names.