MMU: fix enhanced BAT support

I don't know what I can test this on, but it was definitely broken before.
Seems to be a few clock cycles faster too due to the refactoring?
No non-const refs please, use a pointer.