Why Backtesting Matters and How to Do It Right