a little cleanup of utf8–related laziness

This is every place that we call a method from the unicode package on a byte by casting the byte to a Rune. I’ve either replaced the byte with a real rune properly decoded from the string, or I’ve replaced the call with an explicit check of the character.