cpml: fix access violation in cpml_segment_put_next

In the unlikely case there is a path with trailing CPML_MOVE, a next
iteration on the last segment was accessing a single item outside the
CpmlPath.