`menu_animation_update` enumerates `menu_animation.list` to process each
`tween`. It was observed that some tweens execute a callback that
pushes more animations via `menu_animation_push`. During the push, if
the tween `list` does not have enough space, a `realloc` occurs,
potentially invalidating the existing list. The remaining pointer access
in menu_animation_update is therefore invalid. Best case is the memory
is unused and thus does not affect the program. Worst case is memory
corruption.
c00b6e0750