netfilter: x_tables: move hook entry checks into core