Add defensive checks to MetricsSystem methods; make more methods private

This commit adds some defensive checks to `MetricsSystem` which would have caught the error fixed by #3444.

/cc @jerryshao