use `find-root` for reliable package.json lookup

Fixes #1
1.0.3