SAGA: Fix for Bug #3324850 ("ITE (SAGA): crash in dog sewers")

This read of 1 byte past the end of the buffer has existed since
the dragonMove() function was implemented, but since the change
in bfb0986 to use ByteArray, this now causes an assertion due to
the stricter bounds checking.

This commit corrects the original issue.
Thanks to fuzzie for this fix.

engines/saga/actor_walk.cpp

@@ -1168,7 +1168,15 @@ void Actor::moveDragon(ActorData *actor) {
 		dir0 = actor->_actionDirection;
 		dir1 = actor->_tileDirections[actor->_walkStepIndex++];
 		dir2 = actor->_tileDirections[actor->_walkStepIndex];
-		dir3 = actor->_tileDirections[actor->_walkStepIndex + 1];
+		// Fix for Bug #3324850 ("ITE (SAGA): crash in dog sewers")
+		// If there were more than two steps left, get the third (next) step.
+		// Otherwise, store the second step again so the anim looks right.
+		// (If you stop the move instead, Rif isn't automatically knocked into
+		// the Sewer.)
+		if (actor->_walkStepIndex + 1 < actor->_walkStepsCount)
+			dir3 = actor->_tileDirections[actor->_walkStepIndex + 1];
+		else
+			dir3 = dir2;
 
 		if (dir0 != dir1){
 			actor->_actionDirection = dir0 = dir1;