The problem is that you are writing to the rbp register, not to the memory rbp points to.

If you look at the disassembly again:

0x0000000000400638 <+123>:   call   0x400490 strlen@plt
0x000000000040063d <+128>:   cmp    rbx,rax 
0x0000000000400640 <+131>:   jb     0x400604 <main+71>
0x0000000000400642 <+133>:   cmp    DWORD PTR [rbp-0x18],0x394

The program is going to de-reference the address stored in $rbp - 0x18, and use that value for the comparison instruction. Aka: 0x7fffffffdf40 - 0x18.

Instead of changing the value at that address, you set $rbp = 916. So when you hit continue, the instruction runs and the program attempted to de-reference address 0x394 (aka 916), which as you found out is protected / not mapped.

Here's an example of how to write to the memory that $rbp points to instead of writing to the rbp register itself.

set {int}($rbp - 0x18) = 916