Speculative fix for not sending LOCATION UPDATING REJECT

As reported by the operator the rejecting didn't work after the
first fix (wrong logic/missing negation). The hypothesis is that
that the lchan was released before the reject timeout was fired.

Fix it by getting a reference on the lchan when allocating a
logical operation and release the reference when the operation
is finished or timed out.