httpd: saturate parse_short() instead of wrapping

The digit loop accumulated into a uint16_t without a bound, so a query
such as /vlan.json?vid=65540 read as VLAN 4 and every consumer saw a small,
valid-looking number for an out-of-range one. Clamp the result at 0xffff
once another digit would overflow (6552 * 10 + 9 is the last value that
fits). The consumers already reject or mask 0xffff: vlan_get() refuses
anything from 4095 up, send_l2() masks the index to the table size, and
l2_delete() masks the high byte.

httpd/httpd.c

@@ -231,6 +231,9 @@ uint8_t parse_short(__xdata uint8_t *p)
 		c = *p++ - '0';
 		if (c > 9) { break; }
 		err = 0;
+		if (short_parsed > 6552)
+			short_parsed = 0xffff;
+		else
 			short_parsed = (short_parsed * 10) + c;
 	}
 	return err;