add -DCFLAGS to link flags as well because e.g. -fsanitize=undefined needs it

(If anyone needs to control compile and link flags separately,
do say so and it can be made so.)
remove some undefined behavior (fixes #61)

Left-shifting (by a positive amount) signed negative numbers
is undefined behavior.  Found via -fsanitize=undefined.
Now --run-self-tests and basic playing around don't emit any
-fsanitize=undefined errors.

If there's more undefined behavior, let's open new tickets for
it when we find it.