Fix gcc-9 build of joy.cpp

gcc-9 fails to constrain `i`, then warns that very large `i` would
be truncated.  Add `cf_assert` and `xrange` to inform gcc that `i` is
constrained.

common/arch/sdl/joy.cpp

@@ -295,8 +295,9 @@ void joy_init()
 #endif
 
 	const auto n = check_warn_joy_support_limit(SDL_NumJoysticks(), "joystick", DXX_MAX_JOYSTICKS);
+	cf_assert(n <= DXX_MAX_JOYSTICKS);
 	unsigned joystick_n_buttons = 0, joystick_n_axes = 0;
-	for (unsigned i = 0; i < n; i++)
+	range_for (const unsigned i, xrange(n))
 	{
 		auto &joystick = SDL_Joysticks[num_joysticks];
 		const auto handle = SDL_JoystickOpen(i);