fix surface painting format setup

originally the format callback was not locked, but since we intercept
qwidget paints that meant we'd be able to receive paints before the
callback/setup had run. this could then result in a race condition where
if the user was quick enough, or supposedly the system under sufficient
load, that paints would be done on random blobs of invalid data. in
particular when the paint would happen right as the other thread was in
the format setup callback.

to deal with this simply lock the format callback function and ensure we
only paint when the frame has been constructed with actual data (frame
is non-null after the callback since we feed it the plane as data,
making it non-null)

BUG: 434506