pf: Assert that pfil_link() calls succeed

These should only fail if we use them incorrectly, so assert that they
succeed.

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC (“Netgate”’)