Add extra validation for unresolved reference

Without this commit, the parameter will return a Puppet::Resource object
instead of a path. We do not want to do this. By time we are applying
the catalog, if we cannot reseolve the referenced resource, we need to
fail out for safety sake.

This commit adds extra checks and a failure.

In an ideal situation, I'd have the catalog somehow call a final
validation hook on this parameter before marking the catalog as fine and
shipping it to the agent.