netfilter: ipset: off by one in ip_set_nfnl_get_byindex()