AP_Radio: fix cc2500 channel selection

[vlordier]

This draft isolates the cc2500 channel-selection fix from the larger hardening branch.

Summary:

• correct the channel selection loop so replacement channels are chosen from the intended candidate variable rather than the stale outer value
• add focused regression coverage for stale-channel recovery avoiding Wi-Fi-band picks and skipping reserved channel 0

Why:

• this is a tiny, self-contained radio fix and should be reviewed independently of the larger branch

Validation:

• branch was split cleanly from upstream/master
• the branch includes focused regression test source for the channel-selection edge cases in this slice
• not fully validated locally as a standalone branch beyond the split and commit flow
• draft only pending subsystem review