Enforce that `protocols.Message` only has a single type of payload

[geoknee]

We are already sticking to this convention, but don't have any guarantees around it.

Related: messages can support a slice of e.g. payments (and other types), when I think we only use a single payment most/ all of the time.

We probably can't enforce this easily at the type level, so may need a runtime check on incoming / outgoing messages.