remove controls before destroying map

[ansis]

This removes the controls before destroying the map so that:

• the map is in a valid state when onRemove is called for each control
• so that the frame can be cancelled after removal in case onRemove triggers a render frame

fix #7478

• briefly describe the changes in this PR
• write tests for all new functionality
• manually test the debug page

[ryanhamley]

Looks good to me. Seems like calling onRemove after the map was destroyed should always have been considered buggy behavior.