[PATCH 2/3] gdi32/uniscribe: Fix off-by-one bounds check in GPOS_apply_MarkToMark().