Fix flow control on errors

This makes error handlers throw by default so call sites aren't left in an
indeterminate state.

This also adds support for ignoring logging of nested costanza handlers and
the captureErrors flag that prevents errors from propagating to the global
error handler if we have already handled them.