Turn an assert into an exception throw

I'd thought we could always sanitize inputs well enough upstream
(where we could do so more efficiently) that this would never trigger,
but that's apparently not the case.