tgsi/scan: correctly walk instructions in tgsi_scan_tess_ctrl()