[subset] Don't allow malicious fonts to insert unlimited table headers Fixes https://crbug.com/oss-fuzz/16810