An Ounce of Prevention is Worth a Pound of Cure: Formal Verification for Consistent Database Evolution