workspaces: don't segfault on invalid move_surface_to_workspace request

Also fixes the off-by-one in toytoolkit that exposed the issue.
diff --git a/src/shell.c b/src/shell.c
index 6610927..06d8684 100644
--- a/src/shell.c
+++ b/src/shell.c
@@ -548,6 +548,7 @@
 get_workspace(struct desktop_shell *shell, unsigned int index)
 {
 	struct workspace **pws = shell->workspaces.array.data;
+	assert(index < shell->workspaces.num);
 	pws += index;
 	return *pws;
 }
@@ -849,6 +850,9 @@
 	if (workspace == shell->workspaces.current)
 		return;
 
+	if (workspace >= shell->workspaces.num)
+		workspace = shell->workspaces.num - 1;
+
 	from = get_current_workspace(shell);
 	to = get_workspace(shell, workspace);