Safety

[maciejhirsz]

Added a bunch of comments on safety for unsafe code in the stateful module.

In addition:

1. Interacting with Signal will now throw an exception if multiple mutations occur at once (as opposed to silently failing as before).
2. Synchronous event callbacks can now safely borrow state without checks after changes done in #63.
3. Fixed some old generics referencing H for Html before the trait was renamed to View.