> It is possible, however, to craft a malicious grapheme cluster spanning kilobytes (see this SO answer). What to do about that? Well, if we assume that all grapheme clusters that are too big are malicious, then there is no harm in splitting them wherever we want. The chunked messages will contain gibberish in the place where the original grapheme cluster was, but at least we can reliably deliver the rest of the message. If you have a better idea, let me know!

IMO, the appropriate response to something like this is to drop the message in its entirety, taking the classic "let it crash" approach for Erlang/Elixir. No need to pass the known to be malicious message along to potentially less fault tolerant parts of your system.