Fix crash: ThreadGuardedValue accessed after destroy in RunLoop race

[hezhizhen]

When an app is destroyed, CFRunLoopStop is asynchronous — pending AX notification callbacks can still fire and access windows/axApp after destroy() has already set _threadGuarded to nil, causing a crash with "Value is already destroyed".

Add threadGuardedOrNil safe accessor to ThreadGuardedValue that returns nil instead of crashing, and use it in all RunLoop closures in MacApp so they gracefully bail out post-destroy.

Try to fix #1921

PR checklist

• Explain your changes in the relevant commit messages rather than in the PR description. The PR description must not contain more information than the commit messages (except for images and other media).
• Each commit must explain what/why/how and motivation in its description. https://cbea.ms/git-commit/
• Don't forget to link the appropriate issues/discussions in commit messages (if applicable).
• Each commit must be an atomic change (a PR may contain several commits). Don't introduce new functional changes together with refactorings in the same commit.
• ./run-tests.sh exits with non-zero exit code.
• Avoid merge commits, always rebase and force push.

Failure to follow the checklist with no apparent reasons will result in silent PR rejection.

[hezhizhen]

@nikitabobko I know little about Swift, so I let claude code read the source code and error log and it created such a PR. Please check if it fixes the crash if it's okay for you to review an AI-automated PR.