Improve error handling in LSM merge finalizing.

@michaelcahill 
I think there is still a problem if the metadata write fails. We've updated the tree structure, so any crashes are going to recover to the wrong place. OTOH we need to update the tree structure so the metadata update knows what to write.

The only option I can think of is saving the state of the tree prior to making an update and restoring it on error (before releasing the lock)