[core] validate destination enum in handle_sign_tx()

[ivmaykov]

The core logic should not assume that the destination field is always one of GATEWAY or CHANGE. Trust but verify.