util: safeformat (string 'format'-alike, but with type validation)