[image] Fail "imgexec"/"boot" if the image to execute is ambiguous

If there is more than one loaded image, refuse to automatically select
the image to execute.  There are at least two possible cases, with
different "correct" answers:

1. User loads image A by mistake, then loads image B and types "boot".
   User wants to execute image B.

2. User loads image A, then loads image B (which patches image A), then
   types "boot".  User wants to execute image A.

If a user actually wants to load multiple images, they must explicitly
specify which image is to be executed.

src/hci/commands/image_cmd.c

 	} else {
 		image = imgautoselect();
 		if ( ! image ) {
-			printf ( "No loaded images\n" );
+			printf ( "No (unique) loaded image\n" );
 			return 1;
 		}
 	}

src/usr/imgmgmt.c

 }
 
 /**
- * Identify the first loaded image
+ * Identify the only loaded image
  *
- * @ret image		Image, or NULL
+ * @ret image		Image, or NULL if 0 or >1 images are loaded
  */
 struct image * imgautoselect ( void ) {
 	struct image *image;
+	struct image *selected_image = NULL;
+	int flagged_images = 0;
 
 	for_each_image ( image ) {
-		if ( image->flags & IMAGE_LOADED )
-			return image;
+		if ( image->flags & IMAGE_LOADED ) {
+			selected_image = image;
+			flagged_images++;
+		}
 	}
 
-	return NULL;
+	return ( ( flagged_images == 1 ) ? selected_image : NULL );
 }
 
 /**