sysupdate: Check that --instances-max is in bounds

Otherwise user can pass in --instances-max=0 and crash sysupdate with an
assertion failure.

man/systemd-sysupdate.xml

@@ -257,9 +257,9 @@
         <term><option>--instances-max=</option></term>
         <term><option>-m</option></term>
 
-        <listitem><para>Takes a decimal integer greater than or equal to 2. Controls how many versions to
-        keep at any time. This option may also be configured inside the transfer files, via the
-        <varname>InstancesMax=</varname> setting, see
+        <listitem><para>Takes a decimal integer greater than or equal to 2 while updating or 1 while vacuuming.
+        Controls how many versions to keep at any time. This option may also be configured inside the transfer
+        files, via the <varname>InstancesMax=</varname> setting, see
         <citerefentry><refentrytitle>sysupdate.d</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
         details.</para>
 

src/sysupdate/sysupdate.c

@@ -1067,6 +1067,10 @@ static int verb_vacuum(int argc, char **argv, void *userdata) {
 
         assert(argc <= 1);
 
+        if (arg_instances_max < 1)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                      "The --instances-max argument must be >= 1 while vacuuming");
+
         r = process_image(/* ro= */ false, &mounted_dir, &loop_device);
         if (r < 0)
                 return r;
@@ -1090,6 +1094,10 @@ static int verb_update(int argc, char **argv, void *userdata) {
         assert(argc <= 2);
         version = argc >= 2 ? argv[1] : NULL;
 
+        if (arg_instances_max < 2)
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                      "The --instances-max argument must be >= 2 while updating");
+
         if (arg_reboot) {
                 /* If automatic reboot on completion is requested, let's first determine the currently booted image */