Fix a bug where a page could transition from WT_REF_LIMBO incorrectly

We have a bug where a page can transition from WT_REF_LIMBO to WT_REF_MEM, instead of going back to WT_REF_LIMBO.

The symptom is described in WT-3898, we've seen at least one test failure running test format in the form:

t, file:wt.wt, WT_CURSOR.update: __wt_row_modify, 65: cbt->ref->state != WT_REF_LIMBO