The main problem is that we were emitting the row-deleted signal for the model in the middle
of the process that actually deletes the row from the model (remove the row from the array,
update the model->file_lookup hash table, etc.).  In the model's caller, one of the row-deleted
callbacks was requesting an iter, which caused the model to revalidate itself - but it did
this while it was in an inconsistent state.  This led to an assertion failure later when the
model resorted itself.

The fix in remove_file() is like this:

* The filteredness/visibility of the deleted node is not updated.  The
  node will simply be gone; we don't need to update those values at
  all.

* We invalidate just the node that is being deleted.

* The model->file_lookup hash table is not completely nuked; instead,
  we carefully adjust its indices.

* The row-deleted signal is only emitted at the very end, when
  deletion is complete and the model is consistent.

Many thanks to...