When buttons > MP_MAX_TABLET_PAD_BUTTONS and the value is stored in
ictx->tablet_pad_buttons, the next mp_input_set_tablet_pad_focus call
will cause out of bound write, and mp_property_tablet_pos will cause
out of bound read.
Fix this by limiting ictx->tablet_pad_buttons range.
Fixes: 0fbf20f057