bounds-check /Prev pointers

Mirrors the check for startxref. I considered unifying the two into one
test at the start of the loop, but then we would lose the information
whether we got the offset from startxref or a /Prev.