Our previous algorithm had a nonzero probability of picking no events to cancel, which is of course incorrect. The new code uses Vitter's good old reservoir sampling "algorithm R" from 1985. Fixes bug 26008; bugfix on 0.2.6.3-alpha.