TVector: safeguard Pop() against underflow