luci-mod-system: prevent comment injection in mtdbackup endpoint

Rework the parameter handling to both prevent a crash when no parameter is
given and to prevent root command injection through the mtd index part of
the parameter value.

Fixes: 9840d310

 ("modules: add backup module for mtdblock devices")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>