> The recipe in effect invokes undefined behavior in posn-at-point,
> because fci-mode uses a zero-length (a.k.a. "empty") overlay to
> place, in a very convoluted way, a stretch of whitespace followed
> by an image, before the newline.
[snip]
> Since the buffer position of the newline is not "covered" by the
> empty overlay, Emacs happily stops when it reaches the newline,
> oblivious to the fact that on the way it produced the stretch
> glyph of a very large width.

I'm not sure it's due to the overlay having zero length.  Here's a minimal
recipe that provokes the same behavior using a overlay of length 1
(covering the newline):

(progn
  (delete-all-overlays)
  (goto-char (point-min))
  (insert "\n")
  (setq o (make-overlay 1 2)
        s (propertize " "
                      'display '(space :align-to 10)
                      'cursor t))
  (overlay-put o 'before-string s)
  (goto-char (point-min))
  (setq col (car (posn-col-row (posn-at-point (point)))))
  (message (concat "Current column: " (number-to-string col))))