netfilter: change NF_ASSERT to WARN_ON