[romprefix] Fix regression in UNDI loader

Commit 12f203c introduced a bug that caused the UNDI loader to attempt
to load the UNDI code and data segments to incorrect addresses.

src/arch/i386/prefix/romprefix.S

 	pushw	%bx
 	/* UNDI loader parameter structure address into %es:%di */
 	movw	%sp, %bx
-	movw	%ss:12(%bx), %di
-	movw	%ss:14(%bx), %es
+	movw	%ss:16(%bx), %di
+	movw	%ss:18(%bx), %es
 	/* Install to specified real-mode addresses */
 	pushw	%di
 	movw	%es:12(%di), %bx