Fix terminal byte in #US heap

Relevant part of `Partition II, 24.2.4 #US and #Blob heaps`

> [...] This final byte holds the value 1 if and only if any UTF16 character within the string has any bit set in its top byte, or its low byte is any of the following: 0x01–0x08, 0x0E–0x1F, 0x27, 0x2D, 0x7F.  Otherwise, it holds 0. [...]

This commit fixes these cases:

* 0x27, 0x2D => `special` wasn't set
* 0x80-0xFF => `special` shouldn't be set