Consider making map_range return an error for unsafe changes

[qwandor]

In particular, any change which requires break-before-make shouldn't be made while the page table is active. This could check the state of previous_ttbr to determine whether it is active, pass it down into the walker code, and then return an error if some part of the change is invalid in that case.

The problem is that part of the range being mapped might be fine and part might not be, so it might end up creating a partial mapping before realising that it should return an error. Rolling this back isn't safe either. We could do a first walk to check whether it is valid then a second to actually make the change, I guess, but that would introduce a runtime overhead in the normal case.

[qwandor]

Fixed by #36.