Use EOF token instead of NULL.

We used to use null pointers to represent EOFs. That raised the risk
of null pointer access failure because if you forgot null check on
lex() return value, that could cause SIGSEGV.

We had been writing defensive code like this.

  if (tok && tok->kind == NUMBER) ...

Now you can write like this.

  if (tok->kind == NUMBER) ...