vfs: validate ndp state after the lookup
The intent is to remove known-to-be-nops NDFREE calls after many lookups.