sem_remove(): fix the loop that compacts sem array on semaphores removal.

As written now, it copies random kernel memory from beyond the bounds
of the array.

Reported and tested by: pho
Reviewed by: markj
Sponsored by: The FreeBSD Foundation (kib)
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D23694