Design and Model-Based Safety Verification of a Volitional Sit-Stand Controller for a Powered Knee-Ankle Prosthesis