desktop-shell: Guard against invalid seats in get_shell_seat()

Starting with commit 'desktop-shell: Embed keyboard focus handle code
when activating' we are iterating over all the seats when removing a
weston_desktop_surface to be able to invalidate the activate surface.

Upon compositor tear down the shell destroy might invalidate seats
before removal of the weston_desktop_surface making the shell_seat
itself invalid. This wasn't apparent at that time because we're not
handling at that the removal of surfaces from layers.

Signed-off-by: Marius Vlad <marius.vlad@collabora.com>