Use something similar to Swift's rules for initializers, which we may be able to with a combination of types and a proc-macro, to verify that initializers only access the things that they are allowed to.

Should also somehow make ivars safe to declare, by statically ensuring that they are initialized - i.e. this issue ties in heavily with #414).

See also the Objective-C docs on initialization and a bit more about designated initializers.