Protect proc of ensure.

Protect proc of ensure from GC until `ecall` is called.

The following code causes segmentation fault in the current implementation.
```ruby
def test
  begin
    begin
      return
    ensure
      puts "."
    end
  ensure
    puts "."
  end
end

while true
  test
end
```

This issue was found by iij's test case.