date: avoid crash on invalid time

localtime(3) returns NULL when passed an invalid time_t but date(1)
previously did not handle it. Exit with an error in that case.

PR: 220828
Reported by: Vinícius Zavam
Reviewed by: cem, kevans
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D11660