systemctl: immediately reject invalid log levels

Symbolic names and number in the appropriate range are allowed
(log_level_from_string() DTRT already).

The target names are more messy, so we leave the verification to the service.