Function guard 

pub fn guard(f: impl FnOnce() -> u32) -> u32

Wrap one cross-boundary call in catch_unwind.

Since Rust 1.81, letting a panic cross an extern "C" boundary aborts the process outright, and the host cannot help at all – so the plugin has to catch it itself, here.