load.c: fix off-by-one in bounds check for symbol names

Same issue as the pool string fix: the bounds check for
symbol names only validated snl bytes, but the binary
format includes a null terminator. The source pointer
advances by snl+1, so the check must account for it.

Co-authored-by: Claude <noreply@anthropic.com>

src/load.c

@@ -231,7 +231,7 @@ read_irep_record_1(mrb_state *mrb, const uint8_t *bin, const uint8_t *end, size_
         continue;
       }
 
-      if (src + snl > end) return FALSE;
+      if (src + snl + 1 > end) return FALSE;
       if (flags & FLAG_SRC_MALLOC) {
         syms[i] = mrb_intern(mrb, (char*)src, snl);
       }