fix potential null pointer deref in P_MobjFloorZ/CeilingZ

dont think this ever really hit, but boundsec indeed can be null
it also gets checked if its null above anyways, so why not here?

src/p_mobj.c

@@ -601,7 +601,7 @@ fixed_t P_MobjFloorZ(mobj_t *mobj, sector_t *sector, sector_t *boundsec, fixed_t
 			return P_GetSlopeZAt(slope, testx, testy);
 
 		// If boundsec is set, we're looking for specials. In that case, iterate over every line in this sector to find the TRUE highest/lowest point
-		if (perfect)
+		if (perfect && boundsec)
 		{
 			size_t i;
 			line_t *ld;
@@ -696,7 +696,7 @@ fixed_t P_MobjCeilingZ(mobj_t *mobj, sector_t *sector, sector_t *boundsec, fixed
 			return P_GetSlopeZAt(slope, testx, testy);
 
 		// If boundsec is set, we're looking for specials. In that case, iterate over every line in this sector to find the TRUE highest/lowest point
-		if (perfect)
+		if (perfect && boundsec)
 		{
 			size_t i;
 			line_t *ld;
@@ -786,7 +786,7 @@ fixed_t P_CameraFloorZ(camera_t *mobj, sector_t *sector, sector_t *boundsec, fix
 			return P_GetSlopeZAt(slope, testx, testy);
 
 		// If boundsec is set, we're looking for specials. In that case, iterate over every line in this sector to find the TRUE highest/lowest point
-		if (perfect)
+		if (perfect && boundsec)
 		{
 			size_t i;
 			line_t *ld;
@@ -875,7 +875,7 @@ fixed_t P_CameraCeilingZ(camera_t *mobj, sector_t *sector, sector_t *boundsec, f
 			return P_GetSlopeZAt(slope, testx, testy);
 
 		// If boundsec is set, we're looking for specials. In that case, iterate over every line in this sector to find the TRUE highest/lowest point
-		if (perfect)
+		if (perfect && boundsec)
 		{
 			size_t i;
 			line_t *ld;