Disallow unchecked record updates with fromNimber

Previously, one could write 0 {fromNimber=-1} to bypass the
nonnegative check.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>