BLD: try harder to locate Cython executable, it's not always on the path.

Closes gh-2397.