fix: validate offset size in build_bw_frame and adjust payload construction

minimateplus/framing.py

@@ -120,7 +120,15 @@ def build_bw_frame(sub: int, offset: int = 0, params: bytes = bytes(10)) -> byte
     """
     if len(params) != 10:
         raise ValueError(f"params must be exactly 10 bytes, got {len(params)}")
-    payload = bytes([BW_CMD, 0x00, sub, 0x00, 0x00, offset]) + params
+    if offset > 0xFFFF:
+        raise ValueError(f"offset must fit in uint16, got {offset:#06x}")
+    # offset is a uint16 split across bytes [4] (high) and [5] (low).
+    # For all standard reads (offset ≤ 0xFF), byte[4] = 0x00 — consistent with
+    # every captured BW frame.  For large payloads (e.g. SUB 1A / E5 at 0x082A),
+    # byte[4] carries the high byte.  🔶 INFERRED — confirm once E5 is captured.
+    offset_hi = (offset >> 8) & 0xFF
+    offset_lo = offset & 0xFF
+    payload = bytes([BW_CMD, 0x00, sub, 0x00, offset_hi, offset_lo]) + params
     chk = checksum(payload)
     wire = bytes([ACK, STX]) + dle_stuff(payload + bytes([chk])) + bytes([ETX])
     return wire