Fix NULL dereference in xp_open_element

Bail outright if xp_find_start_tag_end fails. The if (ptr) check here
isn't sufficient because later on we'll hit ptr++.

Caught by clang-analyzer.