Update then burn in verifreg's universal_receiver_hook

This _should_ be safe right now as `burn` calls a trusted actor, but it _could_ become an issue if we're not careful. Ideally we'd:

1. Update the state in a transaction.
2. Burn, rolling back the state update on failure.

See: https://github.com/filecoin-project/builtin-actors/blob/05bc73f1f511e7e1e25d3a0ac3ddf34ce6f9f745/actors/verifreg/src/lib.rs#L617-L703