[IR] Fixed off-by-1 error replacing instruction in an instr array

* Fixes occasional crasher running mspec with
  AddLocalVarLoadStoreInstructions pass enabled.