[cmdline] Fix multi-layer variable expansion (again)

Expansion of the (admittedly perverse) "aaa}bbb${ccc" will currently
fail because expand_command() does not check that the closing "}"
occurs later than the opening "${".

Fix by ensuring that the most recent opening "${" is used to match
against the first *subsequent* closing "}".

Total cost of this change: -12 bytes, bringing the overall cost of
this feature to -4 bytes.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

src/core/exec.c

 		for ( tmp = expcmd ; *tmp ; tmp++ ) {
 			if ( ( tmp[0] == '$' ) && ( tmp[1] == '{' ) )
 				start = tmp;
-			if ( tmp[0] == '}' )
+			if ( start && ( tmp[0] == '}' ) ) {
 				end = tmp;
-			if ( start && end )
 				break;
+			}
 		}
-		if ( ! ( start && end ) )
+		if ( ! end )
 			break;
 		*start = '\0';
 		name = ( start + 2 );