ARM: use BX when branch to an address in register