fix off-by-one range clamp in getTokensSet

[zayeem06]

getTokensSet clamps the stop index to the token count rather than count - 1, so a range whose end lands on the token count runs the loop one entry past the last token and get() returns NULL, which the type filter dereferences. The sibling toStringSS in the same file already clamps to size - 1, so I matched it there. While in that loop I also corrected a misplaced parenthesis in the membership test that made getTokensType/getTokensList compare against a boolean instead of passing the token type into isMember, worth a quick look since it changes what those two helpers return.