Sleep code more robust against crystal problems

If the crystal oscillator is nonfunctional, the system will sleep, but
never wake for the once-per-second interrupt.  This could make
debugging a bad crystal oscillator difficult, because the system would
seem to be dead.  Furthermore, because the sleep code is extremely
power efficient, the system can run off power stored in the capacitor
for minutes, so removing the battery and external power will not reset
the system right away.  And if clock power is stored before the
capacitors are drained, the clock will appear to be dead.

To address the issue, the watchdog timer now remains on for the first
five seconds.  After waking five times (once per second), the crystal
oscillator is probably working stably, so only then is the watchdog
disabled to save power.