[Bug]: DeFi - Wallet crashes with invalid responses from API `https://defiadapters.api.cx.metamask.io/positions/`

### Describe the bug

Wallet crashes with invalid responses from API `https://defiadapters.api.cx.metamask.io/positions/`
- top-level token with no nested tokens `Message: Cannot read properties of undefined (reading 'map')`
- Nested underlying missing balance, error: `Message: Cannot read properties of undefined (reading 'toString')`

### Expected behavior

Handle and sanitize responses from API

### Screenshots/Recordings

https://github.com/user-attachments/assets/c8332d04-4f41-4f74-895e-f1d7adcff540

https://github.com/user-attachments/assets/633b9863-5626-4670-91c5-a5b3b6ba0bf6

### Steps to reproduce

1. Setup a proxy
2. Intercept this GET request and subpaths `https://defiadapters.api.cx.metamask.io/positions/`
3. Add this response payloads:

```
{
"data": [
{
"success": true,
"chainId": 1,
"protocolId": "evilproto",
"protocolDisplayName": "Evil Protocol",
"iconUrl": "https://example.com/icon.png",
"positionType": "supply",
"tokens": [
{ "type": "protocol", "address": "0x1111111111111111111111111111111111111111", "symbol": "EVL", "name": "Evil Token", "balance": 1, "price": 1, "decimals": 18 }
]
}
]
}
```

```
{
"data": [
{
"success": true,
"chainId": 1,
"protocolId": "aavelike",
"protocolDisplayName": "AaveLike",
"iconUrl": "https://example.com/icon.png",
"positionType": "supply",
"tokens": [
{
"type": "protocol",
"address": "0x2222222222222222222222222222222222222222",
"symbol": "aTKN",
"name": "Protocol Token",
"tokens": [
{ "type": "underlying", "address": "0x3333333333333333333333333333333333333333", "symbol": "TKN", "name": "Underlying", "price": 1 }
]
}
]
}
]
}
```

### Error messages or log output

```shell

```

### Where was this bug found?

Live version (from official store)

### Version

13.37.0

### Build type

None

### Browser

Chrome

### Operating system

MacOS

### Hardware wallet

_No response_

### Additional context

_No response_

### Severity

_No response_

Start by tracing the TypeScript handling of responses from the `/positions/` API endpoint, then reproduce the two malformed payloads provided in the issue. Done means both missing nested-token arrays and missing underlying balances are sanitized without crashing the wallet, with coverage added where the existing response-handling tests belong.

Written by the indexing model from the issue text.