Get the semantics working for modules that abort

The type soundness theorem is now proved for top-level definitions,
including modules.  The translator is broken, and fixing it is work in
progress.