Return better error when doc._id is not decodable with decodeURIComponent

I've had a case where a doc._id was badly encoded (contained a % sign).

When doing db.sync(), the error was very generic; looking at the originating stack, the culprit was `decodeURIComponent`

This commit fixes that, providing a new errors.MALFORMED_ID to handle that.