[vector] Fix potential use-after-free in check_font()

Reference the new font before destroying the old one, in case
both pointers are the same object.  In practice the caller always
holds its own reference so this cannot trigger, but the pattern
is safer and silences Coverity CID 503195/503196.

Assisted-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/hb-vector-draw.hh

diff --git a/src/hb-vector-draw.hh b/src/hb-vector-draw.hh
index 8f82748..c4a7784 100644
--- a/src/hb-vector-draw.hh
+++ b/src/hb-vector-draw.hh
@@ -59,8 +59,9 @@
     if (font != cached_font || serial != cached_serial)
     {
       changed ();
-      hb_font_destroy (cached_font);
+      hb_font_t *old = cached_font;
       cached_font = hb_font_reference (font);
+      hb_font_destroy (old);
       cached_serial = serial;
     }
   }

src/hb-vector-paint.hh

diff --git a/src/hb-vector-paint.hh b/src/hb-vector-paint.hh
index db287ed..83c529f 100644
--- a/src/hb-vector-paint.hh
+++ b/src/hb-vector-paint.hh
@@ -70,8 +70,9 @@
     if (font != cached_font || serial != cached_serial)
     {
       changed ();
-      hb_font_destroy (cached_font);
+      hb_font_t *old = cached_font;
       cached_font = hb_font_reference (font);
+      hb_font_destroy (old);
       cached_serial = serial;
     }
   }