bmv: check for len being valid in bmv_decode_frame().