[DOM] Fix Fragment removeEventListener dropping tracked listeners (#37160)

Removing an unregistered listener used splice(-1), which deleted the
last tracked entry and left the real handler stuck on DOM children.