Increase cancellation robustness

Calling `cancel()` on already cancelled builds should be a nop. Also
guard against the underlying `system` being deallocated.
diff --git a/lib/BuildSystem/BuildSystemFrontend.cpp b/lib/BuildSystem/BuildSystemFrontend.cpp
index 41ebf1c..fa2afb8 100644
--- a/lib/BuildSystem/BuildSystemFrontend.cpp
+++ b/lib/BuildSystem/BuildSystemFrontend.cpp
@@ -340,10 +340,16 @@
 
 void BuildSystemFrontendDelegate::cancel() {
   // FIXME: We should audit that a build is happening.
+  if (isCancelled_) {
+    return;
+  }
   isCancelled_ = true;
 
   auto delegateImpl = static_cast<BuildSystemFrontendDelegateImpl*>(impl);
-  delegateImpl->system->cancel();
+  auto system = delegateImpl->system;
+  if (system) {
+    system->cancel();
+  }
 }
 
 void BuildSystemFrontendDelegate::resetForBuild() {