Fail fast when a callback thunk is entered above APC_LEVEL

The thunk dispatcher took the VM's fast mutex with no IRQL check. A module
that registers its callback as a DPC or timer routine enters at
DISPATCH_LEVEL, where the KeRaiseIrql(APC_LEVEL) inside ExAcquireFastMutex
is a silent lowering in a free build -- the VM then runs with the wrong IRQL
and the release is equally wrong.

Registering a thunk somewhere it can be called above APC_LEVEL is a module
bug, so crash on it rather than continuing in an unsound state.

Note this is the whole of the IRQL problem. The natives reachable from a
module -- MmMapIoSpace, MmUnmapIoSpace, MmGetSystemRoutineAddress and the
HalGet/SetBusDataByOffset family -- work at APC_LEVEL despite being
documented PASSIVE_LEVEL, so running the VM under the fast mutex is fine.