fix: plug memory map leak, save sp_el0, dynamic UART, kill loop

- Bootloader: reallocate memory map buffer when ExitBootServices fails,
  so GetMemoryMap doesn't scribble past the old allocation on retry.
- vectors.S: actually store sp_el0 into the exception frame. Previously
  it was read into x24 and then… vanished. EL0 tasks would wake up with
  a corrupted stack pointer. Not great.
- Serial: split hardcoded 0x09000000 into a fallback default; add
  SerialUpdate() so the DTB-parsed UART address actually gets used.
- DTB: add bounds check on reserved[] with PMM's 3 extra slots accounted
  for, so malformed/overstuffed DTBs don't silently corrupt memory.
- PMM.h: bump kVMMaxReservedRegions 128→256, define kPMMReservedRegionCount.
- Types.h: remove `#define loop while(1)`. while(true) is fine.
- Rename IOSerial* → Serial* — the IO prefix was redundant, Serial.c
  already lives under IO/.

Kernel/Source/IO/Serial.c

@@ -2,22 +2,28 @@
 #include <Arch/IO.h>
 #include <Arch/CPU.h>
 
-Int32 IOSerialPutCharacter(ASCII character) {
+static UInt64 sUARTAddress = kUARTBaseAddress;
+
+void SerialUpdate(UInt64 address) {
+    sUARTAddress = address;
+}
+
+Int32 SerialPutCharacter(ASCII character) {
     // TXFF -- TRansmit FIFO Full for PL011 is 5 bit of FR reg (0x18)
-    UInt64 uartFR = kUARTBaseAddress + 0x18;
+    UInt64 uartFR = sUARTAddress + 0x18;
 
     while ((IOAddressRead32(uartFR) & (1 << 5)) != 0)  {
         CPUYield();
     }
 
-    IOAddressWrite32(kUARTBaseAddress, character);
+    IOAddressWrite32(sUARTAddress, character);
     return character;
 }
 
-Int32 IOSerialPutString(const ASCII* string) {
+Int32 SerialPutString(const ASCII* string) {
     Int i = 0;
     while (string[i] != '\0') {
-        IOSerialPutCharacter(string[i]);
+        SerialPutCharacter(string[i]);
         i++;
     }