reboot: Don't reboot if the next kernel isn't there

reboot -k garbage won't boot garbage unless /boot/garbage/kernel is
there. Refuse to reboot if it is missing, though allow -f to force
it for special-use cases. This is in keeping with nextboot.sh.

Sponsored by: Netflix
Reviewed by: kevans, kib, markj, emaste
Differential Revision: https://reviews.freebsd.org/D43802