[aat] Fix offsetToIndex math for out-of-bounds values

Previously, some bad font data was accidentally being interpretted as
legit if it happened to not fall out of memory bounds. The intention
of the code was what this commit does.  I'm surprised we weren't getting
a "arithmetic between signed and unsigned values" warning / error
before.
1 file changed