Avoid silently truncating BigInt to Int

- Introduce internal helper `castToInt`, which issues an error when the input
BigInt can't be represented as Int.

- Use `castToInt` wherever we were using `toInt` in a potentially unsafe way.