Gracefully error out when a PAC model is not used in a pac_expectation operator

By the way, also improve the check for when the pac_expectation is used two
times on the same model.