Tighten signature of unchecked_visit_val_obj, fix #595

[graydon]

This does three things:

• Sinks the check for unknown object handles into unchecked_visit_val_obj (it's currently done in all callers).
• Removes the unsafe qualifier, there's really nothing about it that a caller has to think carefully about (and arguably we're misusing unsafe for this purpose all through the codebase, I expect nobody appreciates this instance!)
• Renames the function to be a little less hazardous-sounding: visit_obj_untyped

This (plus earlier work tightening up its args) addresses anything I had in mind for #595