Address book: add bound checking to serialize_hmac_msg