Do not panic across FFI boundaries

[nox]

Any Rust code executed on the C++ side should be wrapped in std::panic::catch_unwind and the panic shouldn't go across the Rust/C++ boundary.