Add asserts to some TokenStreamBase methods, protect against out-of-bounds

Summary:
ASAN-enabled tests on KDE CI show out-of-bounds access issues at least
with kdev-css, so better have this fail for developers with normal
debug builds as well.

Reviewers: KDevelop, kfunk

Reviewed By: KDevelop, kfunk

Subscribers: kfunk, apol, kdevelop-devel

Differential Revision: https://phabricator.kde.org/D6012