audit: be less trusting in transfer functions

[rainbreak]

Functions in transfer.sol are all called internally and are intended to be overridden for custom behaviour. These implemented functions are perhaps too trusting of their input (even though called internally), so consider assertion checks.