In Gtk#, why might VALID_ITER fail even after I check it with IterIsValid?

Question

I have a convenience function in my TreeView that looks something like this:

Card GetCardFromPath (TreePath path)
{
    TreeIter iter;
    if (path == null || !Model.GetIter (out iter, path))
        return null;

    if ((Model as TreeModelSort).IterIsValid (iter))
        return (Card) Model.GetValue (iter, 0);

    return null;
}

Most of the time this works without any errors. But when it is called directly after the Model is changed, line 8 gives me these Gtk runtime errors:

[Fatal 16:53:02.448] [Gtk] gtk_list_store_get_value: assertion `VALID_ITER (iter, list_store)' failed
[Fatal 16:53:02.449] [GLib-GObject] g_value_unset: assertion `G_IS_VALUE (value)' failed

As far as I can tell, I shouldn't even need to check IterIsValid, because I'm already checking the return value of Model.GetIter. Even so, how can VALID_ITER fail in a function that only gets called if IterIsValid returns true?

If it makes a difference, the Model is a TreeModelSort, which sorts a TreeModelFilter, which filters a ListStore. The error occurs when GetCardFromPath is called from HandleSelectionChanged when multiple rows have just been removed from the ListStore. It doesn't seem to prevent anything from working properly, but having a cascade of errors whenever I remove multiple rows isn't really ideal.