iwlwifi: fix canceling monitor_recover timer

To make del_timer_sync() works we have to assure that timer function
does not rearm the timer. To achieve that we cancel timer with
STATUS_EXIT_PENDING bit set in __iwl{3945,}_down function.

Patch also fix priv->txq memory usage after free for iwl3945, because
it move timer cancellation before iwl3945_hw_txq_ctx_free(priv) is called.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>