Fix #116325: crash assigning non-valid material.paint_active_slot

Similar to 64e955f522 (but extended a bit).

Fix by preventing access of non-existent (or out of bounds)
`TexPaintSlot`.

In the future, we should probably even prevent it further by using
`RNA_def_property_int_funcs` (but that is for a later commit).

Pull Request: https://projects.blender.org/blender/blender/pulls/116345

source/blender/blenkernel/intern/material.cc

@@ -1638,6 +1638,14 @@ static bool texpaint_slot_node_find_cb(bNode *node, void *userdata)
 
 bNode *BKE_texpaint_slot_material_find_node(Material *ma, short texpaint_slot)
 {
+  if (ma->texpaintslot == nullptr) {
+    return nullptr;
+  }
+
+  if (texpaint_slot >= ma->tot_slots) {
+    return nullptr;
+  }
+
   TexPaintSlot *slot = &ma->texpaintslot[texpaint_slot];
   FindTexPaintNodeData find_data = {slot, nullptr};
   ntree_foreach_texnode_recursive(ma->nodetree,

source/blender/makesrna/intern/rna_material.cc

@@ -163,7 +163,7 @@ static void rna_Material_active_paint_texture_index_update(bContext *C, PointerR
     }
   }
 
-  if (ma->texpaintslot) {
+  if (ma->texpaintslot && (ma->tot_slots > ma->paint_active_slot)) {
     TexPaintSlot *slot = &ma->texpaintslot[ma->paint_active_slot];
     Image *image = slot->ima;
     if (image) {