Throw exceptions rather than returning NAs on indexing out of bounds; allow unsafe subsetting if users really want it