Minor improvements to ShieldedSeq.

* Append only enlists one commute. There is no gain in having two,
if one is compromised keeping the other as a commute is a waste.
* RemoveAll takes care to still update the _count if the lambda it
received throws an exception.
* ItemKeeper.Value made readonly, ItemKeeper is immutable.