DefaultIOService: defensive checks for IOPlugins

If an opener or saver was not found for a given source, we would get
NPEs. Let's protect against that by checking to see if we got a valid
opener/saver.
ModuleRunner: use cancel(String) if cancelable

The Cancelable interface has a cancel(String) method that is different
from the cancel() method defined by the Module interface, which
apparently is intended for previews.

cancel(String) is what causes Cancelable modules to actually be
considered "canceled" by the isCanceled method.