QEMU VGA: heap out-of-bounds write

A bounds check in the VGA renderer compares text-mode characters against graphics-mode pixels, so the resize is skipped: 960 bytes of guest-controlled palette past a 96-byte heap buffer, on every refresh, on a default machine.