drop use of h_seek in parse_xrefs

Now that we are validating the offset ourselves, we no longer need
h_seek() to do our bounds checking. But add a defensive assert just
in case.