Replaced watcher.MustErr() with non-panicking watcher.EnsureErr()

It's bad to panic in production code for reasons that could
be properly handled, like a stopping watcher. This PR replaces
watcher.MustErr(), which panics when the watcher was stopped
cleanly, with watcher.EnsureErr(), which does the same checks
internally as MustErr, but always returns an error and does
not panic.

This is a follow-up to #799 suggested by fwereade.