more checking for enabled vendors and boxes

push this in the orm view of the world so that you don't see essentially
deleted things