app-layer: add defensive checks

Add defensive checks to most AppLayer API calls as we've observed some
unusual cases making these checks necessary.

Bug #1101. https://redmine.openinfosecfoundation.org/issues/1101

Prscript:
- PR build: https://buildbot.suricata-ids.org/builders/inliniac/builds/235
- PR pcaps: https://buildbot.suricata-ids.org/builders/inliniac-pcap/builds/155