CVE-2015-5330: next_codepoint_handle_ext: don't short-circuit UTF16 low bytes