Fix off-by-one error in binary search