“an incidental or random attack by an employee that merely happens to take place on the employer’s premises during working hours will scarcely justify holding the employer liable. Such an attack is unlikely to be related to the business the employer is conducting or what the employee was asked to do.”