Safely shut down extension hooks.

It was possible to trigger shutting down an extension twice, which could
easily break hooks. Hooks assume they'll be initialized once and shut
down once, but this would break if extensions ever called shutdown on
themselves.

We now check an initialization state on the hook just to be sure before
we do any shutdown work.

Extensions wishing to shut down the hooks should now call
shutdown_hooks() instead of shutdown().