[romprefix] Fix PMM detection start address

Commit fd0aef9 introduced a typo that caused PMM detection to start at
paragraph 0xe00 rather than 0xe000.  (Detection would still work, since it
would scan until it ran out of base memory, but it would end up scanning
an unnecessarily large portion of base memory.)

Spotted by Sebastian Herbszt <herbszt@gmx.de>.

src/arch/i386/prefix/romprefix.S

 	popl	%es:( 0x19 * 4 )
 hook_bbs:
 	/* Check for PMM */
-	movw	$( 0xe00 - 1 ), %bx
+	movw	$( 0xe000 - 1 ), %bx
 pmm_scan:
 	incw	%bx
 	jz	no_pmm