Fix a nil check issue with empty groups

We're hitting an issue where some groups have a `nil` `memberof`. I don't really know why our AD tree is like that, but it causes the split below to blow up. Here's a simple nil check