Add assertions that libui functions are not called on the wrong threads

If a (buggy by definition) user program calls a libui function on a thread from which it is not safe to do so, libui should call `userbug` to kill the program with a useful error message. This is much better than random memory corruption in C code due to race conditions. The latter is almost impossible to debug, especially when the memory corruption happens in closed source libraries that cannot be instrumented with tools such as ThreadSanitizer.

The overhead from these checks should be small enough that they can always be enabled.