arm64/efi: isolate EFI stub from the kernel proper