fix(ui): single-own LXMF router processing

lib/tdeck_ui/UI/LXMF/UIManager.cpp

@@ -476,12 +476,6 @@ void UIManager::update() {
         }
     }
 
-    // Process outbound LXMF messages
-    _router.process_outbound();
-
-    // Process inbound LXMF messages
-    _router.process_inbound();
-
     // Consume UI commands unconditionally. LVGL callbacks only publish into
     // the mailbox; loopTask remains the sole owner of the audio pipeline.
     const uint32_t generation = call_current_generation();

tests/native/test_router_single_owner.py

@@ -0,0 +1,14 @@
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+MAIN = (ROOT / "src/main.cpp").read_text()
+UI_MANAGER = (ROOT / "lib/tdeck_ui/UI/LXMF/UIManager.cpp").read_text()
+
+
+def test_lxmf_router_pumps_have_one_main_loop_owner():
+    """Router processing must not be duplicated inside the render-lock owner."""
+    assert MAIN.count("router->process_outbound();") == 1
+    assert MAIN.count("router->process_inbound();") == 1
+    assert MAIN.count("router->process_sync();") == 1
+    assert "_router.process_outbound();" not in UI_MANAGER
+    assert "_router.process_inbound();" not in UI_MANAGER