CIOUT: buffer the byte where iec_tx_byte sends it from

CIOUT kept the byte to send next in BSOUR ($95), but iec_tx_byte, which
CIOUT and iec_tx_flush (called by UNLSN, UNTLK, LISTEN, TALK) use to
send it, transmits TBTCNT ($A4). So every byte CHROUT sent to a serial
device was whatever TBTCNT held, and a file written with CHKOUT and
CHROUT held the wrong bytes.

The contract (C64 Programmer's Reference Guide, CIOUT): CIOUT sends a
byte to the listening device, always holding one back so that the last
byte goes with EOI when UNLSN ends the transfer. CIOUT now buffers the
byte in TBTCNT, the one-line fix of upstream PR #113; changing the send
path to read BSOUR would also move LOAD's and SAVE's bytes.

Upstream: https://github.com/MEGA65/open-roms/pull/113

src/kernal/iec/ciout.s

@@ -28,9 +28,10 @@ CIOUT:
 	
 ciout_store_in_buffer:
 
-	; Store in the buffer data to be sent next, return
+	; Store in the buffer data to be sent next, return; iec_tx_byte
+	; sends the byte from TBTCNT, so that is our buffer, not BSOUR
 	pla
-	sta BSOUR
+	sta TBTCNT
 	rts
 	
 ciout_send_byte: