Retain the timer so invalidate won't segfault if it already fired

A better solution could be to have the timer call a method on self and
nil it out, but this works too.