Improve parsing of invalid substitutions.

Do not skip over invalid characters. Even if we know the substitution is
invalid either way, the invalid character may affect how the rest of the
substitution is parsed.

Test case:

  : || : ${$""}

src/parser.c

@@ -1445,7 +1445,7 @@ readtoken1_parsesub(char *out, int c, char *eofmark, int flags)
 			default:
 				p = strchr(types, c);
 				if (p == NULL)
-					break;
+					goto badsub;
 				subtype |= p - types + VSNORMAL;
 				break;
 			case '%':