Don't clear metadata through a null display updater.

init() registers the ButtonPressed handler before it fills in the display
updater, so an E_OUTOFMEMORY in between leaves the token set and the
updater null - and the destructor takes exactly that branch, calling
ClearAll() on a null projected interface at process exit.