fix(inventory): disallow buying if !item.canOwn(user)