controller: Don’t allow scaling protected apps to zero

Closes #126