netfilter: x_tables: assert minimum target size