I think you are right -- if someone was to send a GCM notification with just the notification object and no data object (that seems to be valid according to the docs), then data might be null.
Updated the PR to check for params.data beforehand. Nice catch! 👍
As per #254.