[WIN32SS:NTUSER] Return NO_SELECTED_ITEM from NtUserMenuItemFromPoint() when no item is hit (#9121)

Fix the bug, where `NtUserMenuItemFromPoint()` returned `cItems` instead of `NO_SELECTED_ITEM`
when no item is under the point (`mi` is never NULL on a miss), so `MenuItemFromPoint()` callers
could have indexed one past the menu array.

win32ss/user/ntuser/menu.c

@@ -6348,7 +6348,7 @@ NtUserMenuItemFromPoint(
       }
    }
 
-   Ret = (mi ? i : NO_SELECTED_ITEM);
+   Ret = (i < Menu->cItems ? i : NO_SELECTED_ITEM);
 
 Exit:
    UserLeave();