Sanity check key updates

The current key update function allows following bad values.

1. Zero threshold value, when renders multisig contract without any
additional security.

2. Threshold value that is larger than the number of keys, which locks
out the multisig contract completely and renders it useless.

This change adds sanity checks that rejects bad threshold/key pairs as
listed above.

multisig/michelson/generic.tz

@@ -85,6 +85,18 @@ code
           }
           {
             # Change set of signatures
+
+            # Sanity check threshold/key pair
+            DUP;
+            DIP {
+                  UNPAIR;
+
+                  # Check threshold is not zero
+                  DUP; INT; ASSERT_NEQ;
+
+                  # Check threshold less then or equal to number of keys
+                  DIP { SIZE } ; ASSERT_CMPLE; };
+
             DIP { CAR } ; SWAP ; PAIR ; NIL operation
           };
         PAIR }

multisig/michelson/multisig.tz

@@ -80,5 +80,17 @@ code
                   SET_DELEGATE ; CONS }
                 {
                   # Change set of signatures
+
+                  # Sanity check threshold/key pair
+                  DUP;
+                  DIP {
+                        UNPAIR;
+
+                        # Check threshold is not zero
+                        DUP; INT; ASSERT_NEQ;
+
+                        # Check threshold less then or equal to number of keys
+                        DIP { SIZE } ; ASSERT_CMPLE; };
+
                   DIP { SWAP ; CAR } ; SWAP ; PAIR ; SWAP }} ;
     PAIR }