[s] Fixes HTML injections via pet tricks (#87595)

## About The Pull Request

Closes #87592
You could pass additional args into emotes with zero sanitization if you
got yourself a way to call TGUI acts

## Changelog
🆑
fix: Fixed HTML injections via pet tricks
/🆑

code/modules/mob/living/basic/pets/pet_designer.dm

@@ -163,6 +163,9 @@ GLOBAL_LIST_INIT(pet_options, list(
 
 			var/list/trick_moves = params["selected_trick_moves"]
 			if(length(trick_moves))
+				for (var/trick_move in trick_moves)
+					if (!length(GLOB.emote_list[LOWER_TEXT(trick_move)]))
+						trick_moves -= trick_move
 				pet_trick_moves = trick_moves
 
 			var/selected_color = params["selected_carrier"]

code/modules/modular_computers/file_system/programs/virtual_pet.dm

@@ -559,6 +559,9 @@ GLOBAL_LIST_EMPTY(virtual_pets_list)
 				return TRUE
 			if(!isnull(trick_name))
 				pet.ai_controller.set_blackboard_key(BB_TRICK_NAME, trick_name)
+			for (var/trick_move in trick_sequence)
+				if (!length(GLOB.emote_list[LOWER_TEXT(trick_move)]))
+					trick_sequence -= trick_move
 			pet.ai_controller.override_blackboard_key(BB_TRICK_SEQUENCE, trick_sequence)
 			playsound(computer.loc, 'sound/mobs/non-humanoids/orbie/orbie_trick_learned.ogg', 50)