mm: fix boundary checking in free_bootmem_core