Expiry validation now rejects invalid month numbers