flash: bail out of a security-register read of zero length

flash_read_security() ends its loop the same way flash_read_bulk() did
before the previous commit: only through comparisons with 1, 2, 3 and 4. A length of
zero matches none of them, the following subtraction wraps on uint16_t
and the loop keeps printing until the counter comes back down to 4.

No caller passes zero today, since the only one is the CLI with a
constant length of 40, but the bound belongs in the function rather
than in whoever calls it.

rtl837x_flash.c

@@ -262,6 +262,9 @@ void flash_read_bulk(__xdata uint8_t *dst)
 
 void flash_read_security(void)
 {
+	if (!flash_region.len)
+		return;
+
 	flash_configure_sio();
 
 	while (flash_read_status() & STATUS_REG_BUSY_MASK);