KVM: Protect update_cr8_intercept() when running without an apic

update_cr8_intercept() can be triggered from userspace while there
is no apic present.

Signed-off-by: Avi Kivity <avi@redhat.com>