mini-os: fix bugs in memory mapping and exception return path

With libc (e.g., in stubdom), malloc is done with sbrk, which uses
do_map_zero() initially and generates a CoW page fault for lazy
allocation. Previously, do_map_frames didn't handle such do_map_zero()
along with auto-translated mode, only considering the use for grant
table.

Another fix is in exception return path with the same trick as
xen_hvm_callback_vector to prevent GP fault on iretq.