ARM: allow predicated barriers in Thumb mode

The barrier instructions are only "always-execute" in ARM mode, they can quite
happily sit inside an IT block in Thumb.
ARM: fix more cases where predication may or may not be allowed

Unfortunately this addresses two issues (by the time I'd disentangled the logic
it wasn't worth putting it back to half-broken):

+ Coprocessor instructions should all be predicable in Thumb mode.
+ BKPT should never be predicable.