Correct the emulation end address

This only worked before because the BROM was always loaded at address
zero, and the preloader never jumps to anywhere in the BROM. Now it will
properly stop execution upon reaching the end of the BROM/preloader.