Make the BufferQueueChar macro bounds-check KbdBuffered against
KBDBUFFER internally so the RAWKEY and NEWSIZE 'R'-64 paths can
no longer push past the 10-byte queue; widen KbdBuffered to int
so the counter cannot wrap silently in the queue-scan loops.
In amii_cleanup move kill_nhwindows()/DeleteMsgPort() outside
the Forbid()/Permit() pair: CloseWindow can wait on layers.library
semaphores on OS 3.x and that is unsafe under Forbid. Keep only
the IDCMP-flush loop inside.