A couple more clarifications: the addressable 32k memory space is mapped out like an old 8-bit micro (here's a diagram I drew: https://twitter.com/weeble/status/1112527587014787082?s=19 ) and is isolated from real RAM. Code, the lua VM and heap, none of that is accessible via this address space. There's also no allocator. It's up to you to arrange data by hand in the user data region. Pretty much the worst possible consequence of a buffer overflow is stomping the graphics attributes and turning the screen into a kaleidoscope.
Given the other constraints of the system, the main place this code is likely to be used is in a script dedicated to assembling a "cartridge" file, and if the output overflows the target space (likely map or gfx ram) then it's just going to bail out with an error anyway, it's unlikely to care about the stomped-over RAM, given that it can't affect Lua variables or code.