RichTextBox crashes with Chinese IME when replacing multi-line selection (TextStore.OnStartComposition FailFast)

### Description

When using a WPF RichTextBox hosted inside a WinForms application through ElementHost, the application may crash when replacing multi-line selected text using a Chinese IME.

The crash occurs frequently when:

Selecting text containing line breaks

Typing Chinese characters using an IME

Replacing the selected text

The application terminates with Environment.FailFast triggered from TextStore.OnStartComposition.

This appears to be related to the WPF Text Services Framework (TSF) integration.

### Reproduction Steps

1 Create a WinForms application
2 Host a WPF RichTextBox using ElementHost
3 Insert text containing multiple line breaks
4 Switch to Chinese IME
5 Select text across multiple lines
6 Type Chinese characters to replace the selection
7 Repeat several times

Result: Application crashes.

### Expected behavior

Selected text should be replaced normally by IME input.

### Actual behavior

The application requested process termination through System.Environment.FailFast(string message)
Message: 不可恢复的系统错误

Application: testWpfCrash.exe
Framework Version: v4.0.30319
Description: The application requested process termination through System.Environment.FailFast(string message).

Stack:
at System.Environment.FailFast(System.String)
at MS.Internal.Invariant.FailFast(System.String, System.String)
at System.Windows.Documents.TextStore.OnStartComposition(ITfCompositionView, Boolean ByRef)
at MS.Win32.UnsafeNativeMethods+ITextStoreACPSink.OnLockGranted(LockFlags)
at System.Windows.Documents.TextStore.GrantLock()
at System.Windows.Documents.TextStore.GrantLockWorker(LockFlags)
at System.Windows.Documents.TextStore.RequestLock(LockFlags, Int32 ByRef)
at System.Windows.Forms.UnsafeNativeMethods.GetMessageW(MSG ByRef, HandleRef, Int32, Int32)
at System.Windows.Forms.Application.ComponentManager.IMsoComponentManager.FPushMessageLoop
at System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner
at System.Windows.Forms.Application.ThreadContext.RunMessageLoop
at System.Windows.Forms.Application.Run(Form)
at testWpfCrash.Program.Main()

### Regression?

_No response_

### Known Workarounds

_No response_

### Impact

_No response_

### Configuration

Environment：
.NET Framework: 4.8.1
OS: Windows 11 Pro 25H2
IDE: Visual Studio 2022
Architecture: x64
Hosting: WinForms + ElementHost + WPF RichTextBox

### Other information

thanks
[testWpfCrash.zip](https://github.com/user-attachments/files/25965131/testWpfCrash.zip)