Balancing lists: a proof pearl