ipsec: fix protect update log if nexthop is NULL