(?!<normal>).*? will happily match " <normal>"<c>, so you need to check every <c>. to make sure it's not the start of <normal>. Or since you're looking backwards, you could check to make sure every . is not the end of <normal>.

s/
   (?<=<italic>)
   (
      (?: .(?<! <normal>) )*
   )
   <bold>
/$1<bold-italic>/xg
[download]

It's a lot more sane going forward instead of backwards.

s/
   (
      <italic>
      (?: (?!<normal>). )*
   )
   <bold>
/$1<bold-italic>/xg
[download]

By the way, you should use $1 in the second (non-regep) half of the substitution operator.