aes256-ctr: do not left shift more than 16 bits on a signed int.
Spotted by John Regehr and clang -fsigned-integer-overflow