idr: fix a subtle bug in idr_get_next()