bluetooth: userchan: Guard reads from beyond frame size

Even though through code-inspection there isn't a clear path where the
guard wouldn't act upon the length reaching the limit, this check is
moved up to unconditially validate it on every read.

Fixes #84731.

Signed-off-by: Luis Ubieda <luisf@croxel.com>