fix: add null check when walking upvalue list in captureUpvalue

The crash occurred in captureUpvalue() when an upvalue for an earlier local
variable was captured after a later one. The function walked to the end of the
open upvalue list but then dereferenced a NULL pointer when comparing
upvalue->value against the target local slot.

Added a NULL guard before the equality check so that if no existing upvalue
is found, the function correctly proceeds to create a new one instead of
dereferencing a null pointer.

Also fixed a typo in the comment ("existsing" -> "existing").

Added regression test close_over_later_variable.wren that exercises the
scenario of capturing upvalues for locals in reverse declaration order.

test/closure/close_over_later_variable.wren

@@ -0,0 +1,13 @@
+// This is a regression test. There was a bug where if an upvalue for an
+// earlier local (here "a") was captured *after* a later one ("b"), then Wren
+// would crash because it walked to the end of the upvalue list (correct), but
+// then didn't handle not finding the variable.
+
+new Fn {
+  var a = "a"
+  var b = "b"
+  new Fn {
+    IO.print(b) // expect: b
+    IO.print(a) // expect: a
+  }.call
+}.call