In ffs_balloc_ufs{1,2} routines, assert that unwind records do not
overflow local arrays. This is not immediately obvious from the
static code inspection, due to retry logic.

Reviewed by: mckusick
Tested by: pho
Sponsored by: The FreeBSD Foundation
MFC after: 1 week