decode: Make sure numerical escapes are within the Unicode range

Closes #7.