Avoid double-decrement of level->todo

If a libqb application removes a timer from within its own dispatch function, the loop level's todo count is double-decremented. This causes the todo count to become negative, which spoils the calculation of an appropriate poll timeout in qb_loop_run.

This patch avoids the problem altogether by checking that the item is still on the level's item list before decrementing the todo count.

Note that with this patch applied, a related Corosync bug (http://lists.corosync.org/pipermail/discuss/2013-August/002732.html) becomes apparent. Corosync sets a timer interval incorrectly, and with the correct handling of the todo count it ends up consuming 100% CPU. Distributions will want to coordinate their libqb and Corosync releases so that this libqb patch is not sent out before the Corosync one.