Listeners are set up from references in RPN, so check those for bounds
to catch also references resulting from named expressions, database
ranges, tables, ... and references in the token code array that are not
referenced in RPN.

Change-Id: I54770b45818f4c0541a39815278d3271a77b345d
(cherry picked from commit 4baf76dd)