hw: fix race on pager-object dissolve

The HW-kernel, in contrast to other kernels, provides a direct reference
to the pager object with the fault signal that is send to the pager
activation. When accessing this reference directly we may fall into the
time span where the root parent-entrypoint of the faulter has alredy
dissolved the pager object from the pager entrypoint, but not yet
silenced the according signal context.  To avoid this we issue an
additional 'lookup_and_lock' with the received pager object. This isn't
optimal as we wouldn't need the potentially cost-intensive lookup.
However, we also can't simply lock the object at this point as this would
cause the activation to sleep forever if 'remove_locked' is already in
progress. Ideally we would test and lock the lock variable via 'cmpxchg'
and skip the fault if the test fails but that would be quite hacky.

Fixes #1311.
Fixes #1332.