fix: plug memory map leak, save sp_el0, dynamic UART, kill loop

- Bootloader: reallocate memory map buffer when ExitBootServices fails,
  so GetMemoryMap doesn't scribble past the old allocation on retry.
- vectors.S: actually store sp_el0 into the exception frame. Previously
  it was read into x24 and then… vanished. EL0 tasks would wake up with
  a corrupted stack pointer. Not great.
- Serial: split hardcoded 0x09000000 into a fallback default; add
  SerialUpdate() so the DTB-parsed UART address actually gets used.
- DTB: add bounds check on reserved[] with PMM's 3 extra slots accounted
  for, so malformed/overstuffed DTBs don't silently corrupt memory.
- PMM.h: bump kVMMaxReservedRegions 128→256, define kPMMReservedRegionCount.
- Types.h: remove `#define loop while(1)`. while(true) is fine.
- Rename IOSerial* → Serial* — the IO prefix was redundant, Serial.c
  already lives under IO/.

Kernel/Source/KernelMain.c

@@ -3,6 +3,7 @@
 #include <Arch/Timer.h>
 #include <Arch/CPU.h>
 #include <Arch/GIC.h>
+#include <IO/Serial.h>
 #include <VM/PMM.h>
 #include <VM/VMM.h>
 #include <VM/Heap.h>
@@ -17,9 +18,10 @@ void KernelMain(Bootinfo* bootinfo) {
     }
 
     VMBootMemoryMap bootMap = {0};
-    
+
     bootMap.reservedCount = 0;
     DTBParse(bootinfo->dtb, &bootMap);
+    SerialUpdate(bootMap.UART.base);
 
     PMMInitialize(&bootMap);
     VMMInitialize(&bootMap, bootinfo);