Surely it doesn't make sense, but we should return zero instead?

At the two call sites, there are tests against a zero having been returned,
but not against a negative value. And the return value is even passed as the
nArrayLength parameter to a formula::DoubleVectorRefToken constructor, which
is of type size_t, thus unsigned. Passing for instance -4 to it ends up being
interpreted as 18446744073709551612, which has fun consequences.

Change-Id: Ifca97cd4bae8e921345bcf9d0ca6bb040e3c3b79