This fixes a potential system panic if there is already an interrupt pending

Sphinx wants us to make the title underlines the exact same length as
the text above.  Fix all related warnings in our codebase.

If an asynchronous load fails, return to the menu instead of leaving
card10 in a state where no app is running.

Ref: #228

If ELF loading is disabled, return from do_load() early, before
performing a reset of core1 and resetting drivers.

Up to now, the semaphore was locked in core1_wait_ready() and later
freed in core1_load().  This is problematic when only core1_wait_ready()
is called (e.g. due to an invalid payload).

Instead, free the semaphore before leaving core1_wait_ready() and
reaquire it in core1_load().  This way an incorrect call sequence cannot
lead to a lockup.

Ref: #228

All current callers handle this correctly but the assumption that
core1_mutex is locked while calling do_load(), load_async(), or
load_sync() should not be implicit.  Make it more explicit by adding
mutex assertions in all three functions.