Do not let a room we refused build itself back out of the echo

Refusing a membership the file does not claim sends PART, and the server
echoes it back. `assoc-in` on a channel that is not in the map does not
fail — it invents one, a buffer holding a `:joined?` and nothing else,
no name and no unread — so the echo of leaving put the room straight
back in the list, where drawing it threw on `(pos? nil)` and took the
client down a frame later.

Four ways in, and the fourth is why guarding the first three was not
enough: `push-message!` builds the buffer it is handed through
`ensure-channel`, so even "eve left" re-creates the room it is about.
PART and KICK for our own nick are now conditional on holding the room,
`remove-user!` is too, and the join/part/kick lines about other people
are only pushed into rooms we have. A room we are in still reports its
comings and goings; a room we are not is silence.

`conversation-row` also defaults the count it reads. Not the fix —
everything that makes a buffer goes through `ensure-channel` — but the
list draws whatever is in the atom, and a half-made room arriving there
should be a row that reads as quiet rather than the frame that killed
the client.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>