SCI: SQ6: Game crashes when loading an invalid save game from launcher

[csnover]

Reproduction:

1. Download the attached save game and put it into ScummVM Savegames
2. Run ScummVM and choose Space Quest 6 in the launcher
3. Click “Load...” in the launcher
4. Choose the attached save game
5. Click “Load”

Expected: Game shows a dialogue saying the game is invalid, then starts from the beginning

Actual: Game shows a dialogue saying the game is invalid, then crashes attempting to call SQ6::setCursor

Game version: 1.0

Backtrace:

lookupSelector: Attempt to send to non-object or invalid script. Address 0000:0000, method SQ6::setCursor (room 100, script 64994, localCall ffffffff)!
Call stack (current base: 0x6):
 0: script 64994 - SQ6::play()
     obj@0001:29fb pc=0005:037b sp=ST:0000 fp=ST:0000 argp:ST:0001
 1: script 64994 - SQ6::doit()
     by 0 obj@0001:29fb pc=0005:0759 sp=ST:0005 fp=ST:0002 argp:ST:0001
 2: script 0 - SQ6::newRoom(0000:0064)
     by 1 obj@0001:29fb pc=0001:0562 sp=ST:0008 fp=ST:0008 argp:ST:0006
 3: script 64994 - Game::newRoom(0000:0064)
     by 2 obj@0001:29fb pc=0005:0858 sp=ST:0014 fp=ST:000b argp:ST:0009
 4: script 64999 - Event::new(0000:0003)
     by 3 obj@0004:094d pc=0004:0821 sp=ST:0018 fp=ST:0017 argp:ST:0015
 5:[4]  kGetEvent(0000:0003, 000f:0007)
     by 4 obj@0000:0000 pc:none argp:ST:0018
 6: script 0 - SQ6::restore()
     by 5 obj@0001:29fb pc=0001:09a0 sp=ST:001f fp=ST:001d argp:ST:001c
 7: script 64994 - Game::restore()
     by 6 obj@0001:29fb pc=0005:0efa sp=ST:002d fp=ST:0021 argp:ST:0020
 8: script 64994 - SQ6::setCursor(0000:0000, 0000:ffff)
     by 7 obj@0001:29fb pc=0005:0f26 sp=ST:0034 fp=ST:0031 argp:ST:002e

[sluicebox]

This is a script bug and the same thing happens in the original. If you try to load an invalid save from any room other than the main menu, room 100, then it works, otherwise the message box has the wrong palette and then crashes.

Game:restore contains SQ6-specific code that is broken. If the current room is 100 then it skips setting temp1 to the cursor but then always uses it when the restore fails.

[sluicebox]

Fixed in 2ca83c071553d3e8d3db647b87b20b883e4dd9bb