Fix MessageFilter race condition

If MessageFilter does not explicitly stop its callback timer when it's
being destroyed, there is a race condition when that timer is processed in
a callback queue run by a different thread.  Specifically,
maxRateTimerCallback() may be called after messages_mutex_ has been
destroyed, causing a unrecoverable error.