How to write a reliable fault handler on Cortex-M