libweston/desktop: Don't destroy the xdg_surface

Upon xdg_toplevel::destroy we seem to be calling xdg_surface::destroy
destroy handler. Protocol states that we should umap the surface with
client having the posibility to getting another toplevel role for the
same xdg_surface and re-map the window.

This also adds a guard for an unlikely invalid resource.

Fixes: #774

Signed-off-by: Marius Vlad <marius.vlad@collabora.com>