fix underflow

Wish c++ could specify saturating unsigned underflow.