Fix to avoid a crash on bounds-check fail

Fix for #145. 

The `escHeap` flag was set too early causing a crash when `JSON_DecodeObject` later tries to free `ds.escStart` that's still on the stack.