core: Correct slice boundary check in .slice()