Claude review: gpu: nova-core: vbios: limit `BitToken` entry reads

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

This patch adds a check that `header.token_size >= size_of::<BitToken>()` and replaces direct array indexing with `.get()` + `.ok_or(EINVAL)?`.

```rust
+        if entry_size < size_of::<BitToken>() {
+            return Err(EINVAL);
```

This is a correct and important check. If the firmware reports a `token_size` smaller than the `BitToken` struct (6 bytes), the old code would index out of bounds within each entry.

The refactored loop body:

```rust
+            let entry = image
+                .base
+                .data
+                .get(entry_offset..)
+                .and_then(|data| data.get(..entry_size))
+                .ok_or(EINVAL)?;
```

This is cleaner than the old bounds check + direct indexing. The subsequent access to `entry[0]` through `entry[5]` is safe because `entry_size >= size_of::<BitToken>()` (which is 6) was verified up front.

Minor: No error message or `dev_err!` is emitted when `entry_size < size_of::<BitToken>()`. The existing code also didn't emit a message for out-of-bounds, so this is consistent. A `dev_err!` might be helpful for debugging bad firmware in the field, but it's not mandatory.

**Reviewed-by assessment: Good.**

---

---
Generated by Claude Code Patch Reviewer