component: Fix lodash dependency

This patch fixes the ability to use postal.js with component/duo.  The lodash repository is actually `lodash/lodash`, rather than `component/lodash`.

See duojs/duo#349.