in scan_once, prevent the reading of arbitrary memory when passed a negative index

Bug reported by Guido Vranken.
merge 3.2
disallow a negative idx parameter
merge 3.2
fix poor spelling
merge 3.2