validate toml before opening #24

The config file path is not validated before opening, which could potentially allow path traversal if the config_file parameter is user-controlled. While this is likely an internal API, consider adding validation to ensure the config_file path is safe, especially if it will be used in a CLI context where users might provide arbitrary paths.

Originally posted by @Copilot in #22 (comment)