'safe' doesn't capture unbound variables

This works as expected (and is already a test in `t/mac-safe.t`):

```
> (safe (car 'a))
nil
```

This doesn't (and isn't):

```
> (safe x)
Error: ('unboundb x)
```

I'd expect that to return `nil` as well, swallowing the error.