typed arrays: fix 32 bit size/index overflow

Fix an out-of-bound read/write bug due to integer wrapping. Reported by
Dean McNamee.