Add TODOs for unsafe code where we should handle locking explicitly

These issues have been pointed out by Igor Kushnir. Thankfully, the
BKL DUChainLock guards us against failure for now I believe, so this
is not an extremely urgent issue for now.