vlr_subscr_conn_timeout(): don't fire events to discarded fi

Terminating one of the FSM instances may effect termination and deallocation of
the others, as well as the vlr_subscr itself. So, reserve the vlr_subscr
locally, and then dispatch events to exactly those FSM instances that exist.

The changes in expected output in the msc_vlr_tests shows that the subscriber
was deallocated from the first FSM termination, and now sticks around until
we've checked both FSMs are gone.

Change-Id: I56551ecc10f5295fe75944bdde4b583b1b621811
diff --git a/src/libvlr/vlr.c b/src/libvlr/vlr.c
index 4ef52da..59eb37d 100644
--- a/src/libvlr/vlr.c
+++ b/src/libvlr/vlr.c
@@ -973,8 +973,12 @@
 	if (!vsub)
 		return;
 
-	vlr_loc_update_conn_timeout(vsub->lu_fsm);
-	vlr_parq_conn_timeout(vsub->proc_arq_fsm);
+	vlr_subscr_get(vsub);
+	if (vsub->lu_fsm)
+		vlr_loc_update_conn_timeout(vsub->lu_fsm);
+	if (vsub->proc_arq_fsm)
+		vlr_parq_conn_timeout(vsub->proc_arq_fsm);
+	vlr_subscr_put(vsub);
 }
 
 struct vlr_instance *vlr_alloc(void *ctx, const struct vlr_ops *ops)