[morx] Another end-of-text corner case

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10990

src/hb-aat-layout-morx-table.hh

@@ -412,6 +412,8 @@ struct LigatureSubtable
 	  if (uoffset & 0x20000000)
 	    uoffset += 0xC0000000;
 	  int32_t offset = (int32_t) uoffset;
+	  if (buffer->idx >= buffer->len)
+	    return false; // TODO Work on previous instead?
 	  unsigned int component_idx = buffer->cur().codepoint + offset;
 
 	  const HBUINT16 &componentData = component[component_idx];