Added protection against immediate call_out loops

Fixed eval cost error detection within call_out() (changed
max_eval_error to outoftime, because the error handler
always clears the max_eval_error flag before jumping out.)

Added protection against infinite loops caused by call_out
functions recursively adding new 0-second call_outs.  Only
those call_outs which were initially scheduled will receive
the full max_cost budget; any new call_outs added will run
under a single, shared budget.  This protects the driver
from being wedged when infinite call_out loops happen.

fixes issue #16