We were enforcing bounds on the index of an elem_ptr in pointerDeref,
but we want to support out-of-bounds accesses by reinterpreting memory.
This removes that check, so that the deref falls back to bitcasting, as
usual.

This was masked by another bug that was forcing bitcasts incorrectly,
which is why this wasn't noticed earlier.