Avoid crash in Fl::next_window(win)

As documented, Fl::next_window(win) must only be called with a valid
*shown* window. The old code would crash if the argument was NULL
or the window was not shown.

The new code avoids the crash, issues an error message, and returns
NULL to the caller.