Trace from the signal context's r11, not inside the handler.

The r11 is preserved across the handler dispatch, so we still got the
stack, but with extra frames tacked on; it seems better to not record
them than to try to preprocess them out.  But this also means we have to
validate the initial fp value, because FramePointerStackWalk checks only
those it fetches (and doesn't have access to a lower bound other than
that first fp).