#[no_panic] has false-positives, but no false-negatives. If it’s present, the code won’t panic and can’t panic.

Index access violation that “never happens” is the root of every buffer overflow, so I’m absolutely OK with the minimal overhead behind the bounds check for actual safety