bisect: avoid signed integer overflow