RichEditTextDocument crashes when loading RTF file that contains RTL list (bullets/numbering)

### Describe the bug

Using `RichEditTextDocument.LoadFromStream(TextSetOptions, IRandomAccessStream)` or `RichEditTextDocument.SetText(TextSetOptions, String)` throws exception when I attempt to load a RTF file/text which contains a RTL bulleted list and a numbered list.

Exception:
```
System.AccessViolationException
HResult=0x80004003
Message=Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
```
- When using `RichEditTextDocument.LoadFromStream(TextSetOptions, IRandomAccessStream)`:
`at Microsoft.WinUI.dll!ABI.Microsoft.UI.Xaml.IFrameworkElementOverridesMethods.MeasureOverride(WinRT.IObjectReference _obj, Windows.Foundation.Size availableSize)`
- When using `RichEditTextDocument.SetText(TextSetOptions, String)`:
`at Microsoft.WinUI.dll!ABI.Microsoft.UI.Text.ITextDocumentMethods.SetText(WinRT.IObjectReference _obj, Microsoft.UI.Text.TextSetOptions options, string value)`

This is a sample RTF block that reproduce the issue:
```rtf
\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent0{\pntxtb\'B7}}\rtlpar\fi-360\li720\sa200\sl276\slmult1\qr\f0\rtlch\fs22\lang5121\'c7\'e1\'da\'e4\'d5\'d1 \'c7\'e1\'c3\'e6\'e1\par
{\pntext\f2\'B7\tab}\f0\rtlch\lang5121\'c7\'e1\'da\'e4\'d5\'d1 \'c7\'e1\'cb\'c7\'e4\'ed\par
```

The `\rtlpar` control word is what makes the app crash since removing it, or even replacing it with `\ltrpar` control word, doesn't cause crash.

### Steps to reproduce the bug

1. Add a `RichEditBox` element.
```xaml

```
2. Load a `.rtf` file that contains RTL list
```cs
StorageFile file = await StorageFile.GetFileFromPathAsync(@"C:\test.rtf");
IRandomAccessStream randAccStream = await file.OpenAsync(FileAccessMode.Read);
richTB.Document.LoadFromStream(TextSetOptions.FormatRtf | TextSetOptions.UnicodeBidi, randAccStream);
```
`test.rtf` file has the following content (in Arabic):
```rtf
{\rtf1\fbidis\ansi\deff0\nouicompat{\fonttbl{\f0\fnil\fcharset178 Segoe UI;}{\f1\fnil\fcharset0 Calibri;}{\f2\fnil\fcharset2 Symbol;}}
{\*\generator Riched20 10.0.19041}\viewkind4\uc1
\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent0{\pntxtb\'B7}}\rtlpar\fi-360\li720\sa200\sl276\slmult1\qr\f0\rtlch\fs22\lang5121\'c7\'e1\'da\'e4\'d5\'d1 \'c7\'e1\'c3\'e6\'e1\par
{\pntext\f2\'B7\tab}\f0\rtlch\lang5121\'c7\'e1\'da\'e4\'d5\'d1 \'c7\'e1\'cb\'c7\'e4\'ed\par
}
```
3. Run the app and observe the crash

### Expected behavior

I expect `RichEditTextDocument` to be able to load any valid RTF file/text including those containing RTL lists.

### Screenshots

That's what I see when open the sample `.rtf` file using WordPad:

### NuGet package version

WinUI 3 - Windows App SDK 1.6.2: 1.6.241106002

### Windows version

Windows 10 (21H2): Build 19044

### Additional context

Loading the same file works fine in a WPF app!

Start by reproducing the crash with a RichEditBox and the supplied RTF sample, using RichEditTextDocument.LoadFromStream with TextSetOptions.FormatRtf | TextSetOptions.UnicodeBidi and SetText. Inspect the RichEditTextDocument/RichEditBox implementation and the reported Microsoft.WinUI stack frames. Done means the RTL bulleted and numbered list loads without an AccessViolationException.

Written by the indexing model from the issue text.