Prevent errors if destroy is called multiple times on a Control instance

Calling `destroy()` more than once on a control instance results in a JavaScript error in `can.Control.prototype.off` as seen in this [fiddle](http://jsfiddle.net/pNdjr/).

This is a foot gun that is easily disarmed by checking if `this.element === null` before attempting to do anything in `destroy`.

This typically happens when an instances' element is destroyed via DOM manipulation followed by one or more calls to `destroy()`.