Bound the stack and heap a module header can request

cod, dat and hea are all bounded against the file size, but stp only
had a lower bound (stp < hea). data_alloc_count is derived straight
from stp - hea, so a single header field drove the size of the pinned
NonPagedPoolNxCacheAligned allocation. Writing stp = 0xFFFFFFF8 into
the stock pawn/test.amx made init() ask for 4294966543 bytes, which a
large-memory machine can satisfy, once per open handle.

The two guards that look like they cover this,

  (stp - dat) / sizeof(cell) > (cell)~(cell)0 / sizeof(cell)

are vacuous at 32- and 64-bit cells, where the right-hand side already
exceeds anything a uint32 field can produce. They only bite at 16-bit
cells, so they stay.

16 MiB is about 500x what a real module asks for -- pawn/test.amx wants
32 KiB -- and caps the allocation at something sane for non-paged pool.
Verified with a host harness: the oversized header is now rejected
during header validation with no allocation attempted at all, exactly
hea+16MiB still loads, hea+16MiB+8 does not, and pawn/test.amx is
unaffected.