Turns out clang was right in warnung us about the possible division by
zero: we only asserted > 0, but > 1 is the minimum assertion needed to
make the code safe.