ecpg: Split off mmfatal() from mmerror()

This allows decorating mmfatal() with noreturn compiler hints, leading
to better diagnostics.