Don't run ModelToView converter when validation fails

There's a problem with binding inputs to model attributes that fail validation.  If an element binding has a converter, a ModelToView conversion will run, *regardless* of success or failure.  The converter runs against the last valid value in the model, which results in the user's input being reset.

The converter should only be executed when the validation succeeds because a) it doesn't make sense to attempt to run a converter against the invalid input data, b) it keeps the behavior consistent with input bindings that do not provide a converter, and c) it is the preferable user experience to keep the invalid input in the control so the user can correct it.