Use the character substitution code from fntRender() / fntTextWidth() for non-existant characters in fntTextHeight(), too. Otherwise the image height is mis-computed and we allocate an output image that is too small; this could result in malloc heap corruption.