safeService

At the moment, using the `service` function when there are no healthy services available can result in unexpected behaviour, for example the following are given usage examples in the readme:

```
{{ range service "web" }}
server {{ .Name }} {{ .Address }}:{{ .Port }}{{ end }}
```

```
{{ with service "foo" }}
{{ with index . 0 }}
{{ .Node }}{{ end }}{{ end }}
```

In the event that there is no healthy service named web or foo, the first would result in a rendered file with no "server" statement, and the latter would result in a rendered file with no nodes listed.

In some instances the preferred behaviour would be to not render the file at all, ie, replicating the behaviour of `safeTree` or `safeLs` (if I'm understanding how they work anyway).

The obvious approach to make this work without a new function would be something like this:

```
{{ with index (service "foo") 0 }}
# ...
{{ end }}
```

But unfortunately this fails as per the documentation due to the multi-phase execution templates must account for the empty case.

Thoughts around adding a `safeService` function that prevents rendering unless at least one instance is returned?