Use at() for bounds checking

Change-Id: If5b475263e3256d72d3880cf5aed12815e42aa2b