runtime: checked math for Bank::withdraw