Checked conversions between integral types