diff --git a/custom_components/nvidia_shield/connection.py b/custom_components/nvidia_shield/connection.py
index e372185..1a21f63 100644
--- a/custom_components/nvidia_shield/connection.py
+++ b/custom_components/nvidia_shield/connection.py
@@ -556,7 +556,9 @@ class ShieldConnectionManager:
         if cached is not None:
             label, stamp = cached
             if self._clock() - stamp <= APP_LABEL_TTL:
-                return label
+                # empty label = negative cache (t24 F1): the pm dump ran and
+                # found nothing — do not re-enqueue, zero per-heartbeat tax
+                return label or None
             self._app_labels.pop(package, None)  # stale — refetch on demand
         self._app_label_requests.add(package)
         return None
@@ -567,15 +569,18 @@ class ShieldConnectionManager:
         if poller is None or not self.connected:
             return
         try:
+            import shlex
+
             dump = await poller.shell(
-                f"pm dump {package} 2>/dev/null | head -300"
+                f"pm dump {shlex.quote(package)} 2>/dev/null | head -300"
             )
             label = parse_application_label(dump or "")
         except Exception as err:
             _LOGGER.debug("app label fetch failed for %s: %s", package, err)
             return
-        if label:
-            self._app_labels[package] = (label, self._clock())
+        # F1: label-less pm dumps negatively cache too (empty label) so a
+        # later cycle performs zero additional pm dumps for the package
+        self._app_labels[package] = (label or "", self._clock())
 
     def _on_logcat_app_start(self, package: str) -> None:
         """Stamp FIELD_FOREGROUND instantly from a parsed START (P5-3).