Since introducing the SurfaceRegistry we have needed the convention of calling paired functions SurfaceRegistry::remove_surface() + Shell::destroy_surface() and Shell::create_surface() + SurfaceRegistry::register_surface().

As #4479 shows this is error prone.

We should consider introducing an abstraction that wraps this logic and using that in place of directly calling these methods.