This fixes a crash bug when menu validation is invoked before the controller has set up a document. Hardening the other methods is just a precaution (as we generally shouldn’t make assumptions about the state of public properties.