Add a test case for walking a pointer off the start of an array
Introduce and use a version of GEP constfolding which exhibits signed rather than unsigned overflow, and hopefully detects it.

This is to fix cases like gep(0, -1) of @ptr -> gep(bignum, 0) which were preventing the XML example from working properly.