update_menu is not thread-safe on macOS/win32

[simonlindholm]

update_menu is meant to be called from the setup thread, but is currently unsafe to use on macOS/win32, since the main thread may be updating the menu at the same time. In addition, Cocoa requires that UI functions be called from the main thread.

Both implementations of _update_menu need to be changed to pass a message to the main thread, and do the real menu updates there.

macOS has similar problems with update_icon and update_title, and the win32 update_icon implementation should be reviewed as well (update_icon looks safe).

#59 fixed this for the GTK backend.