Native crash (0xc0000005) in Microsoft.UI.Xaml.dll when UIA clients enumerate NavigationView with programmatic items

## Describe the bug

WinUI 3 crashes with an access violation (`0xc0000005`) in `Microsoft.UI.Xaml.dll` when external UIA (UI Automation) clients deeply enumerate the accessibility tree of a `NavigationView` containing programmatically-added `NavigationViewItem` elements. The crash is in native XAML code — no managed frames on the crashing thread.

## Steps to reproduce

1. Create a WinUI 3 app with a `NavigationView`
2. Programmatically add 20+ `NavigationViewItem` elements in code-behind, some with nested children (hierarchical items)
3. Run the app (unpackaged, `WindowsPackageType=None`)
4. Use any UIA client to deeply walk the accessibility tree:
- **FlaUInspect** (hover over the NavigationView area)
- **FlaUI** `FindAllChildren()` recursive walk
- **Accessibility Insights** tree view
5. App crashes within seconds of the UIA enumeration

## Crash details

Two crash sites observed:

| Exception | Offset | Description |
|-----------|--------|-------------|
| `0xc0000005` (Access Violation) | `Microsoft.UI.Xaml.dll+0x35f9d` | Null pointer dereference during automation peer measure/arrange |
| `0xc000027b` (Stowed Exception) | `Microsoft.UI.Xaml.dll+0x39dec5` | WinRT stowed exception during UIA tree walk |

### From Windows Event Log:
```
Faulting module: Microsoft.UI.Xaml.dll, version 3.1.8.0
Exception code: 0xc0000005
Fault offset: 0x0000000000035f9d
```

### From dotnet-dump:
```
OS Thread Id: 0x2bd9c (0)
Child SP IP Call Site
000000EC4F77E200 00007FFA6F948A15 ABI.Microsoft.UI.Xaml.IApplicationStaticsMethods.Start(...)
000000EC4F77E330 00007FFA6F94762C Microsoft.UI.Xaml.Application.Start(...)
000000EC4F77E370 00007FFA6F94714B WinUiSample.Program.Main(System.String[])
```

No managed exception — crash is entirely in native code.

## Key observations

- App is **stable indefinitely** when no UIA client is interacting (tested 60s+)
- Crash is **100% reproducible** when UIA deeply enumerates the NavigationView subtree
- Shallow UIA queries (depth 1-2) generally survive; deep walks (depth 5+) always crash
- Adding `InfoBadge` to `NavigationViewItem` makes the crash more frequent (different automation peers in the tree)
- Crash does **not** occur with XAML-declared `NavigationViewItem` elements (only programmatic)

## Workarounds

1. Limit UIA tree enumeration depth to 3 levels
2. Wrap per-node enumeration in try/catch for `COMException` and `SEHException`
3. When encountering a NavigationView in the UIA tree, enumerate only direct children and stop recursion

## Environment

- **WinUI 3 / WinAppSDK**: Microsoft.UI.Xaml.dll 3.1.8.0
- **Target**: net10.0-windows10.0.26100.0
- **.NET SDK**: 10.0.201
- **OS**: Windows 11
- **Packaging**: Unpackaged (WindowsPackageType=None)
- **DPI**: PerMonitorV2 via app.manifest

Start by reproducing the crash with a programmatically populated NavigationView and a deep UIA walk, then inspect the reported Microsoft.UI.Xaml.dll crash offsets and automation-peer behavior. Done means identifying and fixing the native crash so deep enumeration remains stable, including hierarchical items and InfoBadge cases.

Written by the indexing model from the issue text.