fixed (u)int bounds checking in client API

testing would require writing custom client testing code, leaving decision up to @jheretic about merging.