part 09: explain how Rust prevents iterator invalidation