(fix) Mark replace-map as unsafe because it is exception unsafe.

If the passed-in mapper panics, replace-map will cause destructors
to run twice, which can be memory unsafe.

[breaking-change]