Make LoadFromString not panic but return an error instead.

Change-Id: I9f52fe807c8e9771a530f90ede8bd46fcdb467ae
Delete MustLoadFromString, as nobody needs it.

Change-Id: Ib95c316857ffdd36d973c0e8701967de99d78b13