Fix nvreadsub: repair arg dispatch and widen NV item/index to uint32

[capiman]

nvreadsub was unusable. Its dispatch referenced args.nvreadsub, which
the subparser never sets (it stores the positional arguments as
nvitem/nvindex), so every call raised AttributeError before a frame
was ever sent. Drop the stale comma-split and take the index from
args.nvindex.

In addition, subnvitem_type packed item and index as uint16 ('H'), so
NV items >= 0x10000 (EFS-backed items) failed with
"'H' format requires 0 <= number <= 65535" and could never be
requested. Widen both fields to uint32 ('I'); read_nvitemsub parses
the response with the same struct, so the reply path follows along.

Verified on a live modem (subsystem 0x30, subcommand 1): another valid item
reads back data identical to the legacy nvread path, and items

= 0x10000 are now addressable end to end. The 32-bit field width was
confirmed against one baseband only; other targets may differ.