linux-user: Fix guest signal remapping after adjusting SIGABRT
The arithmetic within the loop was not adjusted properly after SIGRTMIN
was stolen for the guest SIGABRT. The effect was that the guest libc
could not send itself __SIGRTMIN to wake sleeping threads.