Prevent a race between surface destruction and focus

The Wayland protocol is asynchronous, by the time we destroy a surface,
the compositor may have sent a wl_keyboard::enter or wl_pointer::enter
events which now point to no surface, yet we receive it after.

To prevent this race, we can just ignore any enter event targetting a
NULL surface.

Fixes #1150.