Improve robustness of handling malloc failures

Calling dav1d_get_picture() again after it has already returned with an error due to a memory allocation failure could result in crashes.

Although doing so is not a proper API usage, and the outcome is going to be unpredictable, we should at least try to avoid crashing.