desktop-shell: remove surface destroy listener when focus state is destroyed

Changing the focused surface did remove the surface_destroy_listener from the wl_signal list,
but destroying the focus state did not. As a result, sometimes the same listener would be added
to two surfaces, which would join their wl_signal lists together, which would cause infinite
loops and use-after-frees when closing desktop surfaces.

desktop-shell/shell.c

@@ -663,6 +663,10 @@ focus_state_surface_destroy(struct wl_listener *listener, void *data)
 		next = get_default_view(main_surface);
 
 	if (next) {
+		if (state->keyboard_focus) {
+			wl_list_remove(&state->surface_destroy_listener.link);
+			wl_list_init(&state->surface_destroy_listener.link);
+		}
 		state->keyboard_focus = NULL;
 		activate(state->shell, next, state->seat,
 			 WESTON_ACTIVATE_FLAG_CONFIGURE);