Trying to switch cameras with no cameras (killswitched) leads to segfault

The backtrace

(gdb) bt
#0  0x0000aaaae1dfca28 in mp_device_get_pad (id=<optimized out>, device=<optimized out>) at ../device.c:326
#1  mp_device_setup_link (device=0x0, source_pad_id=0, sink_pad_id=0, enabled=enabled@entry=false) at ../device.c:200
#2  0x0000aaaae1dfed04 in update_state (pipeline=0xaaab17a37380, state=0xaaab178acc10) at ../io_pipeline.c:553
#3  0x0000aaaae1dfd5e8 in invoke_impl (args=<optimized out>) at ../pipeline.c:37
#4  0x0000ffff8cb0a234 in g_main_context_dispatch () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#5  0x0000ffff8cb0a5d8 in  () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#6  0x0000ffff8cb0a924 in g_main_loop_run () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#7  0x0000aaaae1dfd604 in thread_main_loop (arg=<optimized out>) at ../pipeline.c:12
#8  0x0000ffff8c752f3c in start_thread (arg=0x0) at pthread_create.c:481
#9  0x0000ffff8c6a3cdc in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:79

shows the device being NULL.

As I'm not sure what exactly should happen in update_state() I'm only able to fix the symptoms by guarding the public API.

There's also issue #14, but they have unrelated causes (here it's a segfault).