drm/radeon/kms: do bounds checking for 3D_LOAD_VBPNTR and bump array limit