Fix off-by-one error in the record count returned by do_e820

Fix off-by-one error in the record count returned by do_e820

%ebx is set to 0 when the last e820 record is returned, which means
that %bp was not incremented for the last record; this change moves
the increment of %bp to earlier in the function, before %ebx is
tested, and after the magic number returned by e820 is checked, so
that %bp is incremented once for every entry.

Also move the test for %ecx=0 (meaning the entry should be skipped)
for correctness.  It doesn't look like qemu ever actually sets %ecx to
0 in practice though.