aCalc: fix off-by-two in INC() runtime stack-overflow guard

[physwkim]

Problem

The aCalc value stack is calloc(ACALC_STACKSIZE) with top = &stack[1],
so the last writable element is stack[ACALC_STACKSIZE-1]. INC()
advances ps, then guards with

if ((ps-top)>ACALC_STACKSIZE) { ... overflow ... }
else { (ps)->numEl = -1; (ps)->sourceDouble = -1; }

Because ps addresses stack[1 + (ps-top)], the write lands out of
bounds once (ps-top) reaches ACALC_STACKSIZE-1. The guard admits
indices ACALC_STACKSIZE and ACALC_STACKSIZE+1 before it trips —
an off-by-two heap overflow of two stackElements.

The postfix compiler caps a purely scalar expression at
ACALC_STACKSIZE, so scalar depth alone never reaches the runtime guard.
But NDERIV/DERIV/FITPOLY push two or three scratch elements at run
time (e.g. NDERIV does DEC then three INCs in aCalcPerform.c) that
the compiler's per-opcode runtime_effect accounting models only as a
net delta, not the transient peak. A deep-but-compiler-accepted
expression such as

1+(1+(1+(1+(1+(1+(1+(1+(1+(1+(1+(1+(1+(1+(1+(1+(NDERIV(AA,2)))))))))))))))))

therefore passes aCalcPostfix() yet drives the runtime stack past its
end, writing out of bounds and crashing the IOC (SIGSEGV).

Fix

Guard on (ps-top) > ACALC_STACKSIZE-2, so INC() rejects before the
write can exceed stack[ACALC_STACKSIZE-1]. Valid stack depths are
unchanged (an expression that legitimately reached the old limit was
already writing out of bounds).

Test

Adds two acalcTest cases around NDERIV: 15 levels of nesting evaluate
normally; 16 levels are rejected by the runtime guard (aCalcPerform
returns non-zero) instead of overflowing. Without the fix the 16-level
case writes out of bounds and terminates acalcTest with SIGSEGV; with
the fix the full suite passes (150/150).