Fix LinExpr.subs() implementation