Fix two issues causing a class of assertion failures found by jsg@ with afl.

Fix two issues causing a class of assertion failures found by jsg@ with afl.
1) rew_sub(): Make sure REWIND_MORE is acted upon even when followed by
REWIND_NONE.  This prevents .It from ending up inside other children of .Bl.
2) blk_exp_close(): Only allow extension of .Bl when it has at least
one .It.  Otherwise, a broken child block could be moved in front of
the .Bl, effectively resulting in a .Bl that ended before it began.