hmap: Fix bug in hmap_replace().