Avoid as much trap as possible in the scheduler

Search for all functions returning `Result<_, Trap>` and fix them if needed.

Good candidates are:
- `MemoryApi::alloc()` should return `World:NotEnough` (or something similar).
- `Applet::{enable,disable}()` should probably return `User::InvalidState`.
- `Scheduler::disable_event()` is similar to above.
- `or_trap!()` should be replaced with `or_fail!()`.

Bad candidates are:
- Wrong memory accesses (e.g. `MemoryApi::{get,get_mut}()`) should continue to `Trap`.

The distinction is not always clear. It would be good to come up with a criteria of whether an operation should trap or error.

This is part of #43.