in scan_once, prevent the reading of arbitrary memory when passed a negative index

Bug reported by Guido Vranken.