fix: incorrect value calculation for scalars passed to functions

d2949e35 introduced a bug wherein the raw value
written to a handle then passed to a function call was computed incorrectly. The
problem was essentially that additions and subtractions were swapped for calls
to ADD and SUB without noting that the latter actually write to their
destination.

Interestingly this was not caught directly by anything in the test suite but was
detected by GCC issuing -Wsign-compare warnings for the model
out-of-range-function-parameter2.m.