Fix menu crash

To correctly interweave the pointer relay, the animation and the completion callback, make sure we
never ever reuse the relay events or callback reference.

Said reuse was causing a stack overflow if a menu comes up underneath the mouse and the pointer is
released before the menu is officially opened.
Add a demo case for that crash

It no longer crashes, but shows off the poor handling of the case where the Menu is under the
pointer event that triggered it.
New strategy for tracking menu items within a menu

With the new hierarchy parenting order, having each menu item notify its parent menu on add/remove
won't work. Instead, use the child added and removed signals and drive the whole process from Menu.
This is much more robust and about the same amount of overhead.