Add a runtime guard that offscreen windows do not generate platform windows

It's come up before, and it's very very difficult to debug without a
backtrace even when you know what's going wrong.