Ensure that we remove a timer prior to manipulation

In some cases, I've seen the timerwheel cascade fault with an invalid
timer pointer.

The theory is that we're disabling but not removing some timers either
at all, or in time for the cascade to trigger and then we get tripped up
over our bad state.

This diff ensures that we remove the timer from its containing wheel
before we either arrange to cancel to reschedule it out later.