The C preprocesor keeps going until there's nothing more to expand. It isn't a question of passes; it's a question of completeness.
It does avoid recursive expansion of macros. Once a macro has been expanded once, it is not re-expanded in the replacement text.
The only thing the standard says about limits on macro expansion is in §5.2.4.1 Translation limits, where it says:
The implementation shall be able to translate and execute at least one program that
contains at least one instance of every one of the following limits:18)
...
- 4095 macro identifiers simultaneously defined in one preprocessing translation unit
18) Implementations should avoid imposing fixed translation limits whenever possible.
So, the preprocessor must be able to handle at least 4095 macros, and if all but one of those macros expand to another macro sequentially, like in your example, the result must be correct.