Fix off-by-one bug in btpand

ul reaches __arraycount(services) before the bound-check happens, causing undefined behaviour.

Reviewed by: imp, jrtc27
Fixes: 7718ced0ea98 ("Add btpand(8) daemon from NetBSD.")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D45463

(cherry picked from commit fbfdf57d65bedfab28f9debc8a4a8d6802f9338a)