The IsSelOvr() in SwCrsrShell::Combine() detects that the PaM with mark
in the last table cell and point ouside the table is invalid, but
unfortunatley restores the wrong position, which does not actually
correct the PaM; the deletion on the invalid PaM then removes the
last SwTxtNode in the document, which leads to crash later.

Change-Id: Ib2ae0b54e6c15dbe5b6811d8696531bf2022e1a4