Make 'push --undo' safer