Need KERNEL_LOCK for now when pushing packets up.

The lock went missing when I switched receive from a rump kernel kthread
to a hypervisor thread; kernel thread was non-MPSAFE and therefore
implicitly held kernel_lock.  Discovered by @galsagie.

XXX: this is only a simple quick fix.  It needs more work because the
lock should be taken only once per delivery batch.  (but of course a
relatively short-term goal is to get rid of kernel_lock entirely)