Extra #read_until performance improvements

Also remove a potential case where an offset is subtracted from nil
if the serialized data is malformed.

Note: this patch changes the behaviour of #read_until to
*include* the "char" that is being searched for. This does
not break the behaviour of the underlying deserializer,
since all uses of #read_until call .to_f or .to_i, which happily
ignore this non-numeric character. Stripping off the char
actually causes a heavy performance hit (either via
an extra read(1) or self.pos += 1). If you want to provide
a #read_until method that has the same behaviour as the previous
implementation, you could do:

  val = string[cpos, idx - cpos]
  self.pos = idx + 1

Instead of:

  val = read(idx - cpos + 1)

Note however that this changes the benchmark result below from
~1.40 to ~1.50 (a ~7% performance hit).

Speed improvement summary (~17% improvement from previous commit):

Previous commit (8780642ad527eaebcfb24649f206a40df57e0cb0)
```
$ ruby benchmark.rb (with patch)
...
user     system      total        real
regular   1.650000   0.000000   1.650000 (  1.649906)
session   0.430000   0.010000   0.440000 (  0.433271)
```

After this patch:
```
$ ruby benchmark.rb
...
              user     system      total        real
regular   1.400000   0.000000   1.400000 (  1.408333)
session   0.390000   0.010000   0.400000 (  0.394359)
```