vt(4): Take font offset into account in vt_is_cursor_in_area()

This fixes a "General protection fault" in vt_vga, where
vt_is_cursor_in_area() erroneously reported that the cursor was over the
text. This led to negative integers stored in "unsigned int" and chaos.

MFC after:	1 week