Make Expression.subs() always return a LinExpr instance