Implement custom deserializer to add our own sanity checks

This is a rough first implementation in preparation of writing
proper serializers independently of QDataStream.

Thanks to @chaign_c (https://twitter.com/chaign_c/) for finding
issues with QDataStream that prompted this change.

(cherry picked from commit 2b777e99fc9f74d4ed21491710260664a1721d1f))