tdb: Make tdb_recovery_allocate overflow-safe