Note that the quantized error is added only to pixels that have not yet been mapped to the palette (quantized)!
This means that after the error has been added in, these pixels will also be mapped, and their error propagated forwards onto other unprocessed pixels.
At the end of the algorithm, every pixel will have been mapped, and the final remaining error will be discarded.
As a result, you should not have any pixels outside of the palette at the end of the quantization operation.