fixed (u)int bounds checking in client API

[dismantl]

testing would require writing custom client testing code, leaving decision up to @jheretic about merging.

[jheretic]

Apparently I sometimes forget how my own debug macros work. No testing necessary.