abaco: guard pagedoubleclick end-of-line branch against nil l->next

pagedoubleclick at page.c:595 dereferences l->next->state with no nil
check.  When the user double-clicks past the right edge of the last
line on a page (no following line), l->next is nil and abaco faults
inside hasbrk.

The mirror beginning-of-line branch at page.c:587 already guards
l->next properly — see "if(l->next && !hasbrk(l->next->state))" on
line 589.  The end-of-line branch was structured symmetrically but
dropped the guard.

Same hunk removes a stray double semicolon at page.c:594
("p->bot = l->lastbox->r.max;;") that the else-if edit left behind.

Minimal fix: one guard added, one spurious semicolon dropped.  No
behaviour change except for the formerly-crashing case, which now
falls through to the box-at-point branch and does nothing (matching
the click-past-end-of-document expectation).

RFC relevance: none

--- sys/src/cmd/abaco/page.c
+++ sys/src/cmd/abaco/page.c
@@ -591,8 +591,8 @@
 				if(hasbrk(l->next->state))
 					break;
 		}
-		p->bot = l->lastbox->r.max;;
-	}else if(xy.x>l->lastbox->r.max.x && hasbrk(l->next->state)){	/* end of line? */
+		p->bot = l->lastbox->r.max;
+	}else if(xy.x>l->lastbox->r.max.x && l->next!=nil && hasbrk(l->next->state)){	/* end of line? */
 		p->bot = l->lastbox->r.max;
 		if(!hasbrk(l->state) && l->prev!=nil){
 			for(l=l->prev; l->prev!=nil; l=l->prev)