Recover binary search tree - morris traversal solution