xquartz: In darwin.c, replace assert calls with tests that call FatalError on failure

In hw/xquartz/darwin.c, replace assert() calls, some of which had side effects in their actual parameters, with tests that call FatalError() on failure.

This pull request contains two commits.

The first commit just moves the side effects out of the assert() statements, so that if assert() is compiled out (which, as Walter Harms pointed on the mailing list, can be done by defining NDEBUG), then important side effects such as calling AllocDevicePair() in filling in a string in another place, will be done.

The second commit replaces the assert() statements with tests that call FatalError() on failure, thanks to recommendations by Walter Harms and Matthieu Herrb, especially considering that the conditions in question were not truly internal consistencies, but rather errors that look like they could happen under certain circumstances.

I do not have an Apple OSX system on which to test these changes, which is part of the reason why I am submitting this as two commits, because, if there is a problem with the conversion to use FatalError but not a problem with moving the side effects out of assert, then git bisect should be able to find that.

By the way, I did look into the fact that the code that is setting the log file name is calling FatalError, and it looks like FatalError should still work in that case, but is an example of why I am trying to backstop that change by separating this change into two commits, with the first commit just moving the side effects out of the assert statements but still using assert.

Thanks for your attention to this merge request.