bugfix: wrap all checks with the provided `max`

`@timeout` is `nil` in this context.  And it turns out, `Timeout.timeout(nil)` does not raise an error. Instead, it helpfully shortcircuits and the block is called with no timeout protection.