mtd: correct upper bounds check for mtd_*() APIs