You had issues before because you didn't have the null check.
When IncidentNumber is null, codeStatement will be "incident_number = ". That is an invalid sql statement, so the Filter() function will fail.
When the Arcade expression is validated, it uses default values (I think, not too sure about that. @jcarlson ?), so the expression didn't get validated because it raised an error, until you set incident to a non-null value.
With the null check I suggested, you return a default response if the IncidentNumber is null. When you return from a script, the rest of the script isn't executed anymore, so Filter() doesn't get a chance to raise an error, so the expression validates.
Have a great day!
Johannes