New validator

This still needs some comments and tests but the basic structure is there. Tear it up.
Its just a matter of wasted processing. The new validator is a lot more resource-hungry than the previous one. The validation phase will not exit early unless the `--validate` flag is given. Its also protected by a recover() call, so any programming errors on my part will be caught.

My concern is just that the boot log will contain warnings about '-' vs '_' and I don't want to unncessarily scare users. On the other hand, if users are relying on it always running, the new behavior might be confusing.