`ref` can be negative in case it refers to an argument. Even though scope !=
frame->base_scope would rule this out (because only base scopes have args),
it was checked *after* the memory access, which would read out of bounds
memory first. This didn't appear as an issue in practice since it's using the
heap pool, so there's probably valid memory before it, but it's still wrong.
Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>