Fix breakage from last commit in update_card()

Testing finds that Customer.save() doesn't accept an `expands`
kwarg after all. The workaround was waiting in the wings, is still
efficient, and this time is confirmed by testing. It sequentially
searches the Customer's (pre-fetched) `cards.data` list until a
card whose `id` matches `default_card` is found.