Improve error handling of format functions

[lucaswerkmeister]

The ceylon-format-* functions wipe the region/buffer empty if there is an error (e. g. because the selection was not a valid declaration), because shell-command-on-region replaces the region regardless of error and ceylon format --pipe doesn’t write anything to stdout in that case. It’s easy enough to undo (C-x u), but still not ideal.

Originally part of #8.