It was just a typo. HMMLToBuffers() passed the global config pointer,
rather than the passed in one, to GenerateNavigation().
Also switch the entire config over to use memory_book style allocation.
This saves us from having to offset pointers when memory gets realloc'd.