false positives and false negatives in function recovery

Sorry for the broad bug title, happy to split this bug report to make it more specific if you prefer, but starting with this for now.

I was doing analysis to test Angr's function recovery accuracy with the following data set: https://github.com/Vector35/function_detection_test_suite/tree/master/busybox

Binaries were compiled with GCC 5.4.0 using the default busybox compile settings with the exception that the `_opt` files were compiled with -O3 whereas those without use -O0.

Results for x86, x64, aarch64 and un-optimized armv7 were significantly better than the results for PPC, optimized armv7, mips (both endian), and arm-thumb which all had on the order of several hundred to several thousand false positives or false-negatives.

The worst offender is: https://github.com/Vector35/function_detection_test_suite/blob/master/busybox/busybox_arm-thumb_stripped.gz

To test, first, the correct list of function starts is extracted via:

```
readelf -a busybox_arm-thumb | awk '$4 == "FUNC" && $7 !="UND" {print $8 " " $2 " " $3}'|uniq|sort
```

Next, that list is compared to a list extracted from angr via:

```
file="busybox_arm-thumb"
p = angr.Project(file, load_options={'auto_load_libs': False})
cfg = p.analyses.CFGFast(cross_references=True, data_references=True)
for fn in p.kb.functions.items():
if fn[1].binary_name == filename and not fn[1].is_plt and not fn[1].is_simprocedure and not fn[1].alignment:
print(str(fn[0]))
```