Fix a thinko in the parsing of substitutions in CommandObjectRegexCommand.

The old code incorrectly calculated the start position for the search
for the third (and subsequent) instance of a particular substitution
pattern (e.g. %1).

I also added a few test cases for this parsing covering this failure.