Prevent balance underflow

[hwwhww]

Issue

• There are several places that we deduct the state.validator_balances[validator_index] for penalties.
• Logically, the validator would be ejected before the balance field is under the risk of underflow.
• But, when we read the function separately, do we need to add some protection to prevent balance underflow? For example, change

state.validator_balances[index] -= penalty

to

state.validator_balances[index] = max(state.validator_balances[index] - penalty, 0)

[vbuterin]

One way to fix this generally would be to define decrement_balance that way in #728.

[JustinDrake]

decrement_balance implemented 🎉