furi_hal_spi: fix same DMA timeout race in TRX/RX path

The TRX/RX branch (else of furi_hal_spi_bus_trx_dma) had the same
race as the TX-only path fixed in b51e744: on timeout the cleanup
released spi_dma_completed before disabling LL_DMA_DisableIT_TC,
so a late or pending DMA completion ISR would call furi_semaphore_release()
on an already-full binary semaphore and crash furi_check.

Pre-existing bug, not introduced by this PR — fixed for symmetry with
the TX-only path now that the pattern is documented.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: WonderMr

targets/f7/furi_hal/furi_hal_spi.c

@@ -393,10 +393,19 @@ bool furi_hal_spi_bus_trx_dma(
             ret = false;
             FURI_LOG_E(TAG, "DMA timeout\r\n");
         }
-        // release semaphore, because we are using it as a flag
-        furi_semaphore_release(spi_dma_completed);
 
+        // Disable TC IRQ and clear pending TC flag BEFORE releasing the
+        // semaphore. On timeout the ISR may still fire and would try to
+        // re-release the binary semaphore, crashing furi_check.
         LL_DMA_DisableIT_TC(SPI_DMA_RX_DEF);
+#if SPI_DMA_RX_CHANNEL == LL_DMA_CHANNEL_6
+        LL_DMA_ClearFlag_TC6(SPI_DMA);
+#else
+#error Update this code. Would you kindly?
+#endif
+
+        // release semaphore, because we are using it as a flag
+        furi_semaphore_release(spi_dma_completed);
 
         LL_DMA_DisableChannel(SPI_DMA_TX_DEF);
         LL_DMA_DisableChannel(SPI_DMA_RX_DEF);