Null-guard the array out-param destructor

arg_wrapper<std::array<cell, N>&>::~arg_wrapper wrote through every pointer
in ps unconditionally, while its cell& sibling correctly guarded with
if (p). init() clears ps before returning access_violation, and the wrapper
tuple is bound with auto&& to a returned temporary, so the destructor still
runs on the error path -- writing to addresses 0, 8, 0x10 and 0x18 at
APC_LEVEL with no enclosing SEH.

Reachable through cpuid, cpu_set_affinity or query_dell_smm with a
misaligned or short array, including from a caller who simply sizes the
output buffer to fewer than four cells.