Check character boundaries before comparing string slices

[djc]

@valkum good point! I decided to invest a little, and rewrote the decode() implementation with an explicit state machine that is a little shorter, quite a bit faster and more likely to be correct -- comes with benchmarks and tests.