mmu: fix page freeing race

We free the page, then remove it from the page table; but other cpus can
still access it during that window, when it may already be allocated to
someone else.

Change the order, and add a FIXME for the TLB flush.