cycle ordering was broken the JSR instruction

bug introduced in db2d84c, which would have first appeared in release
v0.27.0

this subtle bug broke the alignment of the ball and missile in the worm
whomper demo (by Manuel Rotschkar)

this fix adds the cycle boundary after the lo-byte read of the
destination address

Author: JetSetIlly

hardware/cpu/cpu.go

@@ -1326,6 +1326,11 @@ func (mc *CPU) ExecuteInstruction(cycleCallback func() error) error {
 		if err != nil {
 			return err
 		}
+		mc.LastResult.Cycles++
+		err = mc.cycleCallback()
+		if err != nil {
+			return err
+		}
 
 		// the current value of the PC is now correct, even though we've only read
 		// one byte of the address so far. remember, RTS increments the PC when
@@ -1337,24 +1342,7 @@ func (mc *CPU) ExecuteInstruction(cycleCallback func() error) error {
 		if err != nil {
 			return err
 		}
-		mc.LastResult.Cycles++
-		err = mc.cycleCallback()
-		if err != nil {
-			return err
-		}
-
-		// adjust stack pointer
 		mc.SP.Add(0xff, false)
-
-		// address of the hibyte being pushed to the stack is on the bus for an
-		// additional cycle
-		//
-		// it's not entirely clear what's happening here. it might be to
-		// accomodate the SP adjustment but there is no dead cycle later on when
-		// the SP is adjusted again; and nor is there one in RTS when the return
-		// address is read from the stack
-		//
-		// +1 cycle
 		mc.LastResult.Cycles++
 		err = mc.cycleCallback()
 		if err != nil {
@@ -1367,15 +1355,13 @@ func (mc *CPU) ExecuteInstruction(cycleCallback func() error) error {
 		if err != nil {
 			return err
 		}
+		mc.SP.Add(0xff, false)
 		mc.LastResult.Cycles++
 		err = mc.cycleCallback()
 		if err != nil {
 			return err
 		}
 
-		// adjust stack pointer
-		mc.SP.Add(0xff, false)
-
 		// +1 cycle
 		err = mc.read8BitPC(hiByte)
 		if err != nil {