Protect payment reconciliation log allocations

Blocks API edits to read-only allocations and checks the current invoice balance, so an invoice cannot go negative.