cue_next_word() can return a pointer one past the end of the string if
the word is followed by the terminating null byte.