Add %option nodefault to all our flex lexers. Fix a couple of rule gaps

exposed thereby.  AFAICT these would not lead to any worse problems than
junk emitted on the backend's stdout, but we should have the option to
catch possible worse errors in future.