Formal Verification of BDI Agents