target/arm: Use correct mmu_idx for exception-return unstacking