Use JS_ValueToECMAUint32() instead of JS_ValueToInt32() for scan_ptr prop set

scan_cfg and last_read props too. This gives us use of the entire 32-bit range
of an unsigned int. But does someone actually have a message base with message
numbers in the billions?

This is an attempt to fix isssue #792, but I suspect scan_ptr might instead be
trying to be set to NaN or ... ?

src/sbbs3/js_msg_area.c

@@ -321,7 +321,7 @@ static JSBool js_sub_get(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 static JSBool js_sub_set(JSContext *cx, JSObject *obj, jsid id, JSBool strict, jsval *vp)
 {
 	jsval idval;
-	int32		val=0;
+	uint32_t	val=0;
     jsint       tiny;
 	struct js_msg_area_priv *p;
 
@@ -337,16 +337,16 @@ static JSBool js_sub_set(JSContext *cx, JSObject *obj, jsid id, JSBool strict, j
 
 	switch(tiny) {
 		case SUB_PROP_SCAN_PTR:
-			if(!JS_ValueToInt32(cx, *vp, (int32*)&scan->ptr))
+			if(!JS_ValueToECMAUint32(cx, *vp, &scan->ptr))
 				return JS_FALSE;
 			break;
 		case SUB_PROP_SCAN_CFG:
-			if(!JS_ValueToInt32(cx, *vp, &val))
+			if(!JS_ValueToECMAUint32(cx, *vp, &val))
 				return JS_FALSE;
 			scan->cfg=(ushort)val;
 			break;
 		case SUB_PROP_LAST_READ:
-			if(!JS_ValueToInt32(cx, *vp, (int32*)&scan->last))
+			if(!JS_ValueToECMAUint32(cx, *vp, &scan->last))
 				return JS_FALSE;
 			break;
 	}