Fix a list GC bug

The presence of an allocated "elts" pointer is determined by capacity>0,
but the GC handler was incorrectly only choosing to visit it if size>0.
Not all code paths free the elts array if size goes down to zero, so
it could happen that capacity>0 and size=0, and then the elts array would
not be tracked even though it was expected to be.

Added a test that illustrates this.