netfilter: nftables: avoid potential overflows on 32bit arches