Fix [advance|decrease]_nextinv to properly handle wrap-around

Previous logic for advance_nextinv and decrease_nextinv didn't actually work - it tried to use *inv_chars.end() to get the last character, which is actually a pointer to the string's null terminator (and in Debug builds it generates an assertion error and kills the program).