fix: ensure modeL_ exists before calling delegate methods (#20116)
This is a speculative fix for a crash we are seeing in `menuDidClose`. We
can't repro the crash but the traces have it happening in this method
and just by reading through the impl the only part that jumps out as
Might Crash is this `model_` call. Other methods in the menu controller
check `model_` before using it so it probably makes sense to do that here
as well.