Fix message send format string parsing

We had less format strings than parameters for some messages, and we were pushing the param count after each param instead of at the end.