> if you do strlen(s) without checking if there is actually a NUL first

Then your problems have nothing to do with invalid UTF-8, because that issue occurs even in pure ASCII.