Do bounds checking for image.At

this prevents code that assumes that all bounds will work
from crashing. AtF still doesn't do bounds checking for performance
reasons as gc currently can't optimize that away.