change component store to use safe accessor

The component store was accessing its internal array of components
directly. This is bas because no meaningful exception is raised when a
component cannot be found.

This commit does two things. It makes the raw accessor for the
components array private, making the public interface safer. It also
changes the xpath function (the only internal function accessing
components by name) to use the safe [] method.