Avoid signed arithmetic undefined behaviour

These two places look like they obviously rely on undefined behaviour to me. See e.g. http://blog.regehr.org/archives/213 for a primer. In short, the compiler is free to do pretty much whatever it wants if the sum of two signed integers overflow. This includes deleting your wallet file, stopping the process, or simply optimising out the check entirely.

Please review carefully.