[compositor] Prevent crash when extended surface is destroyed.

The surface is not destroyed synchronously with the extended surface
so there is a small chance that something accesses
Surface::extendedSurface() between the time when the extended
surface is destroyed and the Surface itself is cleaned up.