accel/qaic: tighten bounds checking in decode_message()