[aat] Fix two wrongs that made a right before!

Unfortunately our static asserts (DEFINE_SIZE_STATIC) don't actually
fail when used in templates, thanks to SFINAE.  Le sighs.

Probably fixes https://oss-fuzz.com/v2/testcase-detail/5740171484463104

src/hb-aat-layout-common.hh

@@ -164,7 +164,7 @@ struct LookupFormat4
   }
 
   protected:
-  HBUINT16	format;		/* Format identifier--format = 2 */
+  HBUINT16	format;		/* Format identifier--format = 4 */
   VarSizedBinSearchArrayOf<LookupSegmentArray<T> >
 		segments;	/* The actual segments. These must already be sorted,
 				 * according to the first word in each one (the last
@@ -187,7 +187,7 @@ struct LookupSingle
   GlyphID	glyph;		/* Last GlyphID */
   T		value;		/* The lookup value (only one) */
   public:
-  DEFINE_SIZE_STATIC (4 + T::static_size);
+  DEFINE_SIZE_STATIC (2 + T::static_size);
 };
 
 template <typename T>

src/hb-open-type.hh

@@ -833,7 +833,7 @@ struct VarSizedBinSearchArrayOf
   {
     TRACE_SANITIZE (this);
     return_trace (header.sanitize (c) &&
-		  Type::static_size >= header.unitSize &&
+		  Type::static_size <= header.unitSize &&
 		  c->check_array (bytesZ.arrayZ, header.nUnits, header.unitSize));
   }