add Vec::AppendChecked for non-crashy OOM handling