Fix(nbgl): zero pairs list header before freeing backing array

ui_pairs_cleanup() was freeing g_pairs while NBGL could still hold a
pointer to the backing array via g_pairsList->pairs. Any render callback
firing between the free and the next idle screen would dereference freed
memory.

Clear g_pairsList->pairs and nbPairs before APP_MEM_FREE_AND_NULL so
that any in-flight NBGL callback finds an empty list rather than a
dangling pointer.

(cherry picked from commit c2b56f8c9837024d753c1785617f68320450cd43)