Safe SIMD in Rust, even on the inside

Rust’s SIMD abstractions were not as safe as I’d like. Until now.