x86 decoder: BNDMOV decoded as NOP

A common hack for a client to instrument the exact position in the app is to insert NOP_NOP_NOP in the app's source code. However on some systems it found the wrong place. So I took a look closely and found it was caused by three consecutive bndmov instructions decoded as nops.
Intel MPX instructions was introduced in Skylake and it was metioned in [Issue 1312](https://github.com/DynamoRIO/dynamorio/issues/1312) and [Issue 1899](https://github.com/DynamoRIO/dynamorio/issues/1899). It seems the decoder needs to be completed.

This could be verified by having the following code:

``` Assembly
.global _start
_start:
bndmov %bnd0,(%rsp)
bndmov %bnd1,0x10(%rsp)
bndmov %bnd2,0x20(%rsp)
mov %rax,%rax
bndmov 0x20(%rsp),%bnd2
bndmov 0x10(%rsp),%bnd1
bndmov (%rsp),%bnd0
movl $1, %eax
movl $0, %ebx
int $0x80
```

Compile this in gcc and run under dynamoRIO

``` bash
gcc -nostartfiles -nodefaultlibs test.s
drrun -debug -loglevel 3 -- a.out
```

From the log we could see that the bndmov instruction is not decoded properly.

``` Assembly
interp: start_pc = 0x00000000004000d4
new shared vm area: 0x0000000000400000-0x0000000000401000 ---- ELF SO a.out
0x00000000004000d4 66 0f 1b 04 24 data16 nop (%rsp)[4byte]
0x00000000004000d9 66 0f 1b 4c 24 10 data16 nop 0x10(%rsp)[4byte]
0x00000000004000df 66 0f 1b 54 24 20 data16 nop 0x20(%rsp)[4byte]
0x00000000004000e5 48 89 c0 mov %rax -> %rax
0x00000000004000e8 66 0f 1a 54 24 20 data16 nop 0x20(%rsp)[4byte]
0x00000000004000ee 66 0f 1a 4c 24 10 data16 nop 0x10(%rsp)[4byte]
0x00000000004000f4 66 0f 1a 04 24 data16 nop (%rsp)[4byte]
0x00000000004000f9 b8 01 00 00 00 mov $0x00000001 -> %eax
0x00000000004000fe bb 00 00 00 00 mov $0x00000000 -> %ebx
0x0000000000400103 cd 80 int $0x80
```

Reproduce the issue with the supplied test.s assembly, gcc command, and drrun invocation, then inspect the decoder entry point that produces the shown log output. Done means all six BNDMOV instructions are decoded as BNDMOV rather than NOP, with the logged instruction lengths and operands matching the assembly.

Written by the indexing model from the issue text.