Fix fencepost error in format arguments.

The first argument after the list was still being replaced.
Extended test to try the hard stuff.

exec/tests/global/format.js

-const args = [ 1, 1.1, true, "one", -1, 1e9 ];
+const args = [ 1, 1.1, true, "one", -1, 1e9, null ];
 
 const test = {
 	"%s":		"1",
@@ -18,6 +18,10 @@ const test = {
 	"%5$d":		"-1",
 	"%5$x":		"ffffffff",
 	"%6$u":		"1000000000",
+	"%7$u":		"0",
+	"%7$s":		"null",
+	"%7$s %s":	"null %s",
+	"%8$s":		"%8$s",
 };
 
 for (var i in test) {

src/sbbs3/js_sprintf.c

@@ -48,7 +48,7 @@ js_sprintf(JSContext *cx, uint argn, uintN argc, jsval *argv)
 			cur = next;
 		else
 			cur++;
-		if (cur > argc)
+		if (cur >= argc)
 			break;
 		if (JSVAL_IS_DOUBLE(argv[cur]))
 			p = xp_asprintf_next(p, XP_PRINTF_CONVERT | XP_PRINTF_TYPE_DOUBLE, JSVAL_TO_DOUBLE(argv[cur]));