radeon: Fix u32 overflows when determining AGP base address in card space.

The overflows could lead to the AGP aperture overlapping the framebuffer area
in the card's address space when the latter is located at the very end of the
32 bit address space, which would result in a freeze on X server startup,
probably because the card read commands from the framebuffer instead of from
AGP.

See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=392915 .