diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6ac322..00513db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,11 @@ single running list until the first versioned release.
 
 ## Unreleased
 
-_Nothing yet._
+- **Fix:** the radio **crashed** when navigating the Messages menu with voice
+  prompts enabled. Menu strings added after the voice-prompt pack was built map
+  to a table-of-contents slot that doesn't exist; the player read past the end
+  of the table. Such strings now play silence instead (also hardens the
+  pre-existing strings sitting at the end of the table).
 
 ## 0.7.0
 
diff --git a/MDUV380_firmware/application/source/functions/voicePrompts.c b/MDUV380_firmware/application/source/functions/voicePrompts.c
index a105fbc..63cf9c1 100644
--- a/MDUV380_firmware/application/source/functions/voicePrompts.c
+++ b/MDUV380_firmware/application/source/functions/voicePrompts.c
@@ -352,13 +352,25 @@ void voicePromptsAppendLanguageString(const char *languageStringAdd)
 		return;
 	}
 
-	voicePromptsAppendPrompt(NUM_VOICE_PROMPTS +
+	int promptNumber = NUM_VOICE_PROMPTS +
 			((languageStringAdd - currentLanguage->LANGUAGE_NAME)
 #if ! defined(HAS_COLOURS)
 					- ((languageStringAdd >= currentLanguage->theme_chooser) ?
 							((currentLanguage->theme_colour_picker_blue - currentLanguage->theme_chooser) + LANGUAGE_TEXTS_LENGTH) : 0)
 #endif
-			) / LANGUAGE_TEXTS_LENGTH);
+			) / LANGUAGE_TEXTS_LENGTH;
+
+	// Language strings added after the voice prompt pack was built have no
+	// entry in the table of contents. voicePromptsPlay() reads TOC[promptNumber + 1],
+	// so anything at or past the last slot would read past the array and crash;
+	// play silence for those instead.
+	if ((promptNumber < 0) || (promptNumber >= (VOICE_PROMPTS_TOC_SIZE - 1)))
+	{
+		voicePromptsAppendPrompt(PROMPT_SILENCE);
+		return;
+	}
+
+	voicePromptsAppendPrompt(promptNumber);
 }
 
 void voicePromptsPlay(void)