[smt] correct comparison for out-of-bounds memory access check (#2463)

This fixes an off by one error, where 3 was erroneously
accepted as in-bounds for a memory of depth=3