wayland-surface: Don't crash if a client destroys a buffer in use

This is considered "undefined" by upstream. Right now GTK+ does this
a lot, so we shouldn't crash. Let's make them crash instead and send
them an error instead.