Fix a race in vm_page_pagequeue_lockptr().

[markj]

Summary

We check for m->queue == PQ_NONE but later use m->queue as an index. In
between the two references, the value of m->queue may change to PQ_NONE.
(The locking protocol ensures that m->queue cannot transition between
two queue indices: either the from-value or the to-value must be
PQ_NONE.) Read the value of m->queue once to avoid this problem.

Test Plan

Gleb reported seeing panics as a result of the use of a bogus
index into the pagequeue array, and also reported that this patch
fixed the panics.