nouveau: Avoid NULL deref of pushbuf on flush

The fix in f911daf1 is incomplete for nouveau; PUSH_KICK is called before the DrawBuffer check, which causes a similar traceback:

PUSH_KICK (push=0x0)
nouveau_flush
_mesa_make_current
_mesa_free_context_data
nouveau_context_deinit
nv10_context_destroy
nouveau_context_destroy
driDestroyContext
dri2_destroy_context
glXDestroyContext

Closes: #10030