Yet more handle refcount fixes

Locked objects are now accepted even when they have zero refcounts.

Waves now actually can be locked! Seems to make sense, since for
some reason, a2_upload_export() tries to use that for the built-in
waves...