Prevent NewGRFs from using Action A to replace internal sprites

src/newgrf.cpp

@@ -7129,7 +7129,13 @@ static void SpriteReplace(ByteReader *buf)
 		for (uint j = 0; j < num_sprites; j++) {
 			int load_index = first_sprite + j;
 			_cur.nfo_line++;
-			LoadNextSprite(load_index, *_cur.file, _cur.nfo_line); // XXX
+			if (load_index < (int)SPR_PROGSIGNAL_BASE || load_index >= (int)SPR_NEWGRFS_BASE) {
+				LoadNextSprite(load_index, *_cur.file, _cur.nfo_line); // XXX
+			} else {
+				/* Skip sprite */
+				grfmsg(0, "SpriteReplace: Ignoring attempt to replace protected sprite ID: %d", load_index);
+				LoadNextSprite(-1, *_cur.file, _cur.nfo_line);
+			}
 
 			/* Shore sprites now located at different addresses.
 			 * So detect when the old ones get replaced. */

src/spritecache.cpp

@@ -705,6 +705,11 @@ bool LoadNextSprite(int load_index, SpriteFile &file, uint file_sprite_id)
 
 	if (type == ST_INVALID) return false;
 
+	if (load_index == -1) {
+		if (data != nullptr) _last_sprite_allocation.Clear();
+		return false;
+	}
+
 	if (load_index >= MAX_SPRITES) {
 		usererror("Tried to load too many sprites (#%d; max %d)", load_index, MAX_SPRITES);
 	}