In ghostify() and unghostify(), trigger a fatal error if the
object is insane.  This prevents a segfault (or, worse, arbitrary
memory corruption) later.

The test suite isn't bothered by this, and neither is bringing
up a Zope and playing around with it.  The only known cause
appears to be threading problems related to Transience.py,
partly explained in issue #1350.  It should be impossible for
these fatal errors to trigger via thread-correct use of ZODB.

I don't expect to keep these fatal errors in the code; indeed,
I'm checking this in only in Zope's *copy* of ZODB.  The intent
is to help whoever can make time for 1350 know whether that
problem still exists, until that problem goes away.  Unfortunately,
it's not even possible to raise an exception from ghostify()
(it's a void routine that "can't fail"), so it takes an extreme
measure to catch the problem as soon as it's visible.