bugfix: wrap all checks with the provided `max`

`@timeout` is `nil` in this context.  And it turns out,
`Timeout.timeout(nil)` does not raise an error. Instead, it
helpfully shortcircuits and the block is called with no
timeout protection.
Merge pull request #15 from mikegee/respect-max

bugfix: wrap all checks with the provided `max`