add formatChecked(), which does not crash on bad format strings