Nice work. I've added the missing range check. When memory has grown to the sizes where arrays with more than 2 billion elements actually becomes feasible, we'll change the type for array.size.
It'd be really nice if it was possible to specify type checks for custom format strings, i.e. like the gcc __attribute__ ((format (printf, 1, 2))) feature but with a custom format spec instead of printf. This would also be useful for the new string_builder_sprintf and e.g. Pike_error that uses it. (There are currently many false alarms from gcc since Pike_error still is declared to take a printf style format string.)