cirrus_vga: fix off-by-one in blit_region_is_unsafe