create() creates invalid package if package names contains underscores

[krlmlr]

...or is otherwise malformed:

The mandatory ‘Package’ field gives the name of the package. This should contain only (ASCII) letters, numbers and dot, have at least two characters and start with a letter and not end in a dot.

At least a warning will be great; I'd be fine with accepting only legal package names, too.