i386: fix return to 16-bit stack from NMI handler