Fix candidate selection on unknown package

Before this fix having dependency on unknown package with version or
repository limitation caused updater to fail on lua error. This fixes
that and adds small comment noting that we should remember that we might
depend on unknown package.