Return errors instead of panicking

[samueltardieu]

Right now, the various algorithms in which arithmetic operations happen may panic if, for example, bounds are exceeded. Using saturating arithmetic is not possible because it could silently yield incorrect results, and the current type bounds do not allow using either saturating or checked arithmetic. Moreover, using unchecked arithmetic operations may lead to different results in debug (panic) and release (silent wrapping) modes.

Requiring checked arithmetic and using Result types would constitute a better behavior. This change requires breaking the API and will require a major release.

This has been reported in #598.