Prevent empty event.from results

I think a modify and a delete could race with the event.from code:
initially the object would be modified but not deleted, but then
when we try to take the snapshot we find it's gone but not (yet)
in the deleted list. This would cause us to return an empty set of
events. Fix this by looping around.

Signed-off-by: David Scott <dave.scott@eu.citrix.com>
Move the subscription parse/match code into a sub-module

Signed-off-by: David Scott <dave.scott@eu.citrix.com>