cpu-exec: fix icount out-of-bounds access