bugfix: wrap all checks with the provided `max`

`@timeout` is `nil` in this context.  And it turns out,
`Timeout.timeout(nil)` does not raise an error. Instead, it
helpfully shortcircuits and the block is called with no
timeout protection.