memory: abort if a memory region is destroyed during a transaction

memory: abort if a memory region is destroyed during a transaction

Destroying a memory region is illegal within a transaction, as until
the transaction is committed, the memory core may hold references to
the region.  Add an assert to check for violations of this rule.

Signed-off-by: Avi Kivity <avi@redhat.com>