When cdef-singlepass is enabled, it is possible to signal the
CDEF parameters in such a way that we end up with unsigned
integer overflow in constrain().

Fix this by i) using signed instead of unsigned values,
and ii) clamping the result to avoid going on to shift
by a negative amount.

Change-Id: Ib677b2d644e44000c54959f7280e646bf02054da