Should `UintRef` always be at least one limb?

There are several functions that operate on the first limb, are infallible, and panic if the limb slice is empty. I removed `pub` on the inner tuple struct field so `UintRef` could actually potentially maintain invariants, and at-least-length-1 seems like it would have some nice benefits in terms of eliminating potential panics. `Uint` constructors generally ensure at least one limb. (I'm also trying to remember if this holds true for `BoxedUint` as it doesn't seem to be written down).