#307 AV is destroyed twice

[Sean Hefty]

If a send MAD from UM is outstanding when the app
crashes, the kernel proxy code will try to clean up. The
AL instance for the app will be destroyed, which will
cascade deletion of an AV. The MAD service will then
be destroyed, which will cancel all outstanding send
MADs. The send MAD will try to destroy any allocated
AVs. This can result in an AV being destroyed twice.

A different mechanism needs to handle destruction. All
MAD services should be destroyed (or just all sends
should be canceled) before any AVs are destroyed.