x86/xen: fix upper bound of pmd loop in xen_cleanhighmap()