Bugfixes in type substitution

- bounds are considered correctly
- substitution on types is simultaneous