seat: guard against button count corruption

This is still a compositor bug, and bad events will be sent to clients. We'll
need to track each button separately to handle this in wlroots.

types/seat/wlr_seat_pointer.c

@@ -345,9 +345,13 @@ uint32_t wlr_seat_pointer_notify_button(struct wlr_seat *wlr_seat,
 			wlr_seat->pointer_state.grab_time = time;
 		}
 		wlr_seat->pointer_state.button_count++;
+	} else {
+		if (wlr_seat->pointer_state.button_count == 0) {
+			wlr_log(WLR_ERROR, "Corrupted seat button count");
 		} else {
 			wlr_seat->pointer_state.button_count--;
 		}
+	}
 
 	struct wlr_seat_pointer_grab *grab = wlr_seat->pointer_state.grab;
 	uint32_t serial = grab->interface->button(grab, time, button, state);