Update device model locking

Update device model locking

Change all iterators of devices to:
- use list_for_each
- check return of get_device_locked
- don't break until we hold the lock if we get an error

When a device's reference count hits 0, remove it from all lists, including
bus and driver lists.

Between the iterator algorithm and the guaranteed removal from the lists,
there should never be a device in a list with a reference count of 0.
So, whenever we're iterating over the lists, we'll always have a valid
device. We don't decrement the refcount until the next iteration of the
loop, so we're also guaranteed to get the correct next item in the list.