Abort on double-failure. #910

Previously this was an `rtabort!`, indicating a runtime bug. Promote
this to a more intentional abort and print a (slightly) more
informative error message.

Can't test this sense our test suite can't handle an abort exit.

I consider this to close #910, and that we should open another issue about implementing less conservative semantics here.