[ot-font] Fix hmtx table length checking, *again*

Exactly the same problem that I fixed in
63ef0b41dc48d6112d1918c1b1de9de8ea90adb5

I rewrote the table checking yesterday in
67f8821fb25d9bd55719f5e29a582ae1af4b02b3
and introduced the exact same issue again. :(
Good thing we have ongoing fuzzing going now.  Was discovered
immediately by libFuzzer.  Thanks kcc!

https://github.com/behdad/harfbuzz/issues/139#issuecomment-153449473
Fixes https://github.com/behdad/harfbuzz/issues/156