[3.7.0] A_CustomPunch armorbonustype param causing VM abort

[Kinsie]

I'm not entirely sure exactly when this was introduced commit-wise, but 3.7.0 is the first mainline release I was able to find this issue in.

REPRO STEPS:
1.) Load the included DECORATE file into GZDoom.
2.) Give yourself the "TestFist" weapon.
3.) Punch a monster. Preferably right in the nose.

EXPECTED RESULTS:
The monster takes damage or dies, and the player receives some of the inflicted damage back as BasicArmorBonus armor.

OBSERVED RESULTS (FROM 3.7.2):

VM execution aborted: tried to read from address zero.
Called from StateProvider.A_CustomPunch at gzdoom.pk3:zscript/inventory/stateprovider.txt, line 301
Called from TestFist.StateFunction.4 at decorate.txt:DECORATE, line 22
Called from PSprite.Tick at gzdoom.pk3:zscript/shared/player.txt, line 2265
Called from PlayerPawn.TickPSprites at gzdoom.pk3:zscript/shared/player.txt, line 429
Called from PlayerPawn.PlayerThink at gzdoom.pk3:zscript/shared/player.txt, line 1449
Called from weapon state TestFist.4 in TestFist
Called from PSprite.SetState [Native]

[Graf Zahl]

I think this got introduced when A_CustomPunch was scriptified. There's a bad type cast on the offending line.

[Kinsie]

Thanks for the speedy fix!