drm/atomic: fix out of bounds read in for_each_*_in_state helpers