Catch unwinds in native callbacks

According to [this article](https://blog.rust-lang.org/inside-rust/2020/02/27/ffi-unwind-design-meeting.html), unwinding across FFI boundary is still a UB, which we'd better avoid. 
Even though we can carefully examine our code to ensure that no `unwrap` is there, accidents can still happen, turning a programming mistake into a live accident.