SurfaceFlinger: DispSync: negative offsets when model is unlocked

When getting a HWVsync timestamp in DispSync, we correct the last event
time to reflect the actual HWVsync time by setting it based on HWVsync.
This logic needs to account for both positive and negative offsets.

Bug: 135631964
Test: sanity
Change-Id: I77a1e13d739e558d6cdf43c298e6fcee49d517b5