cabac: add overread protection to BRANCHLESS_GET_CABAC().