Improve culprit detection

Use last frame that is marked as part of app, or last frame if no app frames are available.