ARM: fix an off-by-one in the register list access

Fix an off-by-one access introduced in 224502 for push.w and pop.w with single
register operands.  Add test cases for both scenarios.

Thanks to Asiri Rathnayake for pointing out the failure!