The destroy() method did not check the isDisposed flag before calling
OS.DestroyIcon/OS.DeleteObject. If called twice, it would pass an
already-freed handle to the OS, risking undefined behavior. Add an
early return when the handle is already disposed.