MIPS Runtime exception and Address out of range

Hello I am trying to write this code for a project and at the end of the code I am getting the error "line 84: Runtime exception at 0x004000dc: address out of range 0x0000006e" I am new to MIPS and can not figure out how to resolve this. The purpose of the code is for a user to enter a string and manipulate as they desire and to print the new string at the end. Any help??

.data
Prompt1: .asciiz "Your current string is: \n"
Prompt2: .asciiz "\nDo you want to make any changes to the string? (Y/N) \n"
Prompt3: .asciiz "\nEnter the character in the string would you like replaced: \n"
Prompt4: .asciiz "\nEnter what you would like to change the character to: \n"
Prompt5: .asciiz "\nYour final string is: "
Word: .space 40
yes: .asciiz "y"

.text
#######################
#Print Instructions
li $v0, 4
la $a0, Prompt1
syscall
#getting text from the user
li $v0, 8 #print string
la $a0, Word 
li $a1, 40
syscall
#########################
Loop:
#yes or no 
li $v0, 4
la $a0, Prompt2
syscall

li $v0, 8 #get input
la $a0, Word 
li $a1, 2
move $t0, $a0 #save string to $t0
syscall

lb $t1, yes  
lb $t0, 0($t0) 

bne $t0, $t1, endloop

#replace char
li $v0,4
la $a0, Prompt3 #replace char message
syscall

li $v0, 12 #read in char
syscall
addi $s0, $v0, 0 #store char in $s0

li $v0, 4
la $a0, Prompt4 #new char message
syscall

li $v0, 12
syscall
addi $s1, $v0, 0 #store new char in $s1

la $t0, Word
li $t1, -1 

j Loop

replaceLoop:
lbu $t2, 0($t0)    #load our input's first char is at
addi $t0, $t0, 1   #increment address of our string.
addi $t1, $t1, 1
beq $t2, $s0, replace #check if char in input, matches
beq $t2, $0, endloop      #char we want to replace.

replace:
sb $s1, -1($t0)
b replaceLoop

endloop:

li $v0, 4
la $a0, Prompt5
syscall

li $v0, 4
la $a0, ($t0)
la $a1, 40
syscall

#exit program
li $v0,10       
syscall