Claude review: gpu: nova-core: vbios: limit `BitToken` entry reads

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

Good fix. The old code checked `entry_offset + header.token_size > data.len()` but then accessed individual bytes at `entry_offset`, `entry_offset + 1`, etc. without verifying `token_size >= sizeof(BitToken)`. If `token_size` were smaller than 6, the accesses could read beyond the entry.

The new code:
```rust
if entry_size < size_of::<BitToken>() {
    return Err(EINVAL);
}
```
validates upfront, then uses `.get()` with safe slicing. The refactor to index via `entry[0]`, `entry[1]`, etc. is cleaner and bounds-safe since `entry` is guaranteed to be at least `entry_size` long, which is at least `size_of::<BitToken>()`.

No issues.

---
Generated by Claude Code Patch Reviewer