iwl3945-base.c: fix off-by-one errors

This patch fixes two off-by-one errors resulting in array overflows
spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>