fn ceil_char_boundary(s: &str, pos: usize) -> usize
Smallest byte index >= pos that is a char boundary.