Make the out-of-bounds check more straightforward

As discussed in PR #14, it's easier to understand that way and
does not depend on `data.session.name` having the same number of
bytes as `msg[]`.