Fix crash when accepting change

The problem is the use of cursor movement methods to update cursor.
Cursor::forwardPos() steps into insets, which is not always what we
want. The problem here is that there is a math inset just after the
accepted change, and that the cursor steps into it for some reason.

This code is a nightmare anyway.

Fixes: bug #9145

src/lyxfind.cpp

@@ -400,7 +400,7 @@ bool findChange(DocIterator & cur, bool next)
 			if (!next)
 				// if we search backwards, take a step forward
 				// to correctly set the anchor
-				cur.forwardPos();
+				cur.top().forwardPos();
 			return true;
 		}