Avoid as much trap as possible in the scheduler

[ia0]

Search for all functions returning Result<_, Trap> and fix them if needed.

Good candidates are:

• MemoryApi::alloc() should return World:NotEnough (or something similar).
• Applet::{enable,disable}() should probably return User::InvalidState.
• Scheduler::disable_event() is similar to above.
• or_trap!() should be replaced with or_fail!().

Bad candidates are:

• Wrong memory accesses (e.g. MemoryApi::{get,get_mut}()) should continue to Trap.

The distinction is not always clear. It would be good to come up with a criteria of whether an operation should trap or error.

This is part of #43.