drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]