bottom-up expression traversal

First step toward actual type checking!