scope: refuse `&x` where x is a local variable