Attempt to keep ProtoNode always in a state that can be encoded without errors
to avoid cases where the panicing methods may be forced to panic on error.

go-codec-dagpb will error when encoding either of the following cases:

* The Hash field in links should always be set, cannot be cid.Undef
* The Tsize field needs to fit into an int64, otherwise it'll overflow to
  negative which is not allowed

Error on cases where a user may attempt to set links that will eventually
error on encode. Then when we do encode, silently handle these cases if they
manage to slip through (e.g. if they come in from a decoded block with a
bad form).