Guard subsurface parent access.

Whilst a subsurface must have a parent at the time of creation, the
lifespan is not guaranteed afterwards.

It's a weird thing for a client to do, but we need to not crash
afterwards.

If the parent surface is destroyed we should consider the surface
unmapped.

BUG: 452044