Changed lfs_toleb128 to assert on buffer overflow

We should always know the worst-case leb128 size when calling
lfs_toleb128, so it's really a developer-error if lfs_toleb128 results
in a buffer overflow.

This is different from lfs_fromleb128, since we use lfs_fromleb128 to
parse on-disk leb128s, which may be corrupted, incomplete, malformed,
etc.

Changing this to an assert (unreachable really) saves a bit of code
since the compile can eliminate the LFS_ERR_CORRUPT that was only
reachable via developer-error:

           code          stack
  before: 37884           3048
  after:  37872 (-0.0%)   3048 (+0.0%)

lfs_util.c

@@ -30,7 +30,8 @@ ssize_t lfs_toleb128(uint32_t word, void *buffer, size_t size) {
         }
     }
 
-    return LFS_ERR_CORRUPT;
+    // buffer overflow?
+    LFS_UNREACHABLE();
 }
 
 ssize_t lfs_fromleb128(uint32_t *word, const void *buffer, size_t size) {
@@ -51,6 +52,7 @@ ssize_t lfs_fromleb128(uint32_t *word, const void *buffer, size_t size) {
         }
     }
 
+    // truncated?
     return LFS_ERR_CORRUPT;
 }