Maybe a debug-only assert() behind a preprocessor toggle and/or a more controvertial runtime exception?