Problem: Heap UAF if a terminal buffer is deleted during TermRequest in Normal mode. Solution: Increment terminal refcount before triggering TermRequest, and destroy the terminal if the buffer is closed during that.