Unless some buggy code messes up the head/tail pointers.
Just for completeness, your int now = millis() should actually be unsigned.
As a side note:
Since the actual TX doesn't happen with the Serial.print() statement but async to your code Cellular.off() (and its effects) might be the source of the TX corruption, which might be something to investigate (@BDub ?)