ioapic_intsrc() indexes ioc_intsrc[] with only a debug-compiled-out bounds guard

Summary

ioapic_intsrc at ioapic.c:274 guards its write into fixed-size ioc_intsrc[ISA_IRQ_CNT=16] array solely with KKASSERT(irq < ISA_IRQ_CNT). KKASSERT compiles to no-op unless INVARIANTS defined (systm.h:116-119). The assertion also omits lower-bound check (irq<0): negative int param would pass <16 test. Today NOT exploitable because every caller (acpi_madt.c:586 probe rejects SourceIrq>=16; mptable.c:1208 rejects src_bus_irq>=16; default-config uses literal irq=0) pre-validates firmware fields. But the functions OWN contract is a debug assertion, not a real guard, so any future caller regression or probe/enum inconsistency becomes a static-data OOB write. Fix: replace KKASSERT with always-on irq<0||irq>=ISA_IRQ_CNT bounds check.