eliminate two bug nats, one by making deq return an option and the other
by proving that it cannot happen