The problem is the use of cursor movement methods to update cursor.
Cursor::forwardPos() steps into insets, which is not always what we
want. The problem here is that there is a math inset just after the
accepted change, and that the cursor steps into it for some reason.
This code is a nightmare anyway.
Fixes: bug #9145
if (!next)
// if we search backwards, take a step forward
// to correctly set the anchor
- cur.forwardPos();
+ cur.top().forwardPos();
return true;
}