Enforce non-negative `$timeout` parameter

[TravisCarden]

#413 surfaced the fact that it's not safe to accept non-negative $timeout parameter values and updated docblocks accordingly. Let's actually enforce the constraint and add test coverage.