boxed: Track ownership of boxed pointer better

This is the second bug of this type that I've fixed since refactoring this code, so clearly we need to do something differently. We rename m_not_owning_ptr to m_owning_ptr and make sure it starts out false (so that we never try to free a pointer if it wasn't assigned yet.) Then we introduce two methods for setting the m_ptr field: own_ptr() which sets m_owning_ptr, and share_ptr() which does not. We use these methods consistently everywhere that we previously set m_ptr directly.

Closes #240 (closed)