syntax: convert the lexer to use Option<char> over transmute(-1).

The transmute was unsound.

There are many instances of .unwrap_or('\x00') for "ignoring" EOF which
either do not make the situation worse than it was (well, actually make
it better, since it's easy to grep for places that don't handle EOF) or
can never ever be read.

Fixes #8971.
rustc: put range asserts on `char` loads.

A `char` is a Unicode codepoint, and so ranges from 0--0x10FFFF (with
the surrogate gaps): we may as well inform LLVM of this.