ng_parse: Add upper bound to avoid possible overflow

Also move num initialization for clarity.

We still need to check num in ng_unparse_composite (reported by des@ in
D52151) but this is another incremental improvement in netgraph input
validation.

Reviewed by: des
PR: 267334
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52151