A manipulated database could trigger an assertion failure, because the
parent didn't match.  Do a proper check if the new directory is within
the parent's.  This uses FATAL() to bail out, so MPD still dies, but
it doesn't crash.