add assumption to prompt_to_i2_correct

not allowing multiple declarations within a single prompt outside of a
module. this enables proving half of the cheat (the error case for a
single top-level declaration). the other half (error from a module)
remains to be looked at.