Load the module and call it in protected mode so that we can bubble
up errors rather than breaking the system further.
Note that we cannot make any guarantees about the state of the
environment if an error occurred; changes may have still been partially
applied depending on the shape/size/position of the error.