The arena was reused when it shouldn't after a Release() call.

In the future, it would be ideal if wrongful Release() calls could be
flagged (either through an error or panic).

This moves the check for released messages earlier in the Release() call
for transport messages. This prevents triggering the race detector, due
to the check happening before an attempt is made at accessing the
message (which involves indirection through a segment that may have been
released already).

While the prior code would not have actually caused a fault in current
code (because the conditional checks both for the released flag and
whether the message is nil), checking by the release flag first is
more correct and may prevent future bugs.

Previously this was not enforced by the Encode function. While this
limit is unlikely to be hit in practice, it's important to assert it due
to the type allowing it and a count of segments greater than 2^32
causing an invalid marshaling.