tearing: fix UAF on destroy

Fixes: 9a1c411abd

sway/desktop/tearing.c

@@ -29,6 +29,8 @@ static void handle_tearing_controller_destroy(struct wl_listener *listener,
 		void *data) {
 	struct sway_tearing_controller *controller =
 		wl_container_of(listener, controller, destroy);
+	wl_list_remove(&controller->set_hint.link);
+	wl_list_remove(&controller->destroy.link);
 	wl_list_remove(&controller->link);
 	free(controller);
 }