[Dev] Stricter parsing

- after replace_call, left symbols for x (state) and control (u) are necessarily typos
- they don't error at parse, and might not generate runtime errors if such variables are defined in the calling env

Fix: after replace_call, replace all state and controls symbols by a gensym (will error at runtime); better: if expression `has` state or control, it must be an error (should be checked at every line)