Make start_timer() and stop_timer() robust against incorrect usage.

src/include/gpxe/retry.h

 	struct list_head list;
 	/** Timeout value (in ticks) */
 	unsigned long timeout;
-	/** Start time (in ticks) */
+	/** Start time (in ticks)
+	 *
+	 * A start time of zero indicates a stopped timer.
+	 */
 	unsigned long start;
 	/** Retry count */
 	unsigned int count;

src/net/retry.c

  * be stopped and the timer's callback function will be called.
  */
 void start_timer ( struct retry_timer *timer ) {
+	if ( ! timer->start )
+		list_add ( &timer->list, &timers );
 	timer->start = currticks();
 	if ( timer->timeout < MIN_TIMEOUT )
 		timer->timeout = MIN_TIMEOUT;
-	list_add ( &timer->list, &timers );
 	DBG2 ( "Timer %p started\n", timer );
 }
 
 	unsigned long old_timeout = timer->timeout;
 	unsigned long runtime;
 
+	/* If timer was already stopped, do nothing */
+	if ( ! timer->start )
+		return;
+
 	DBG2 ( "Timer %p stopped\n", timer );
 	list_del ( &timer->list );
 	runtime = currticks() - timer->start;
+	timer->start = 0;
 
 	/* Update timer.  Variables are:
 	 *
 	/* Stop timer without performing RTT calculations */
 	DBG2 ( "Timer %p stopped on expiry\n", timer );
 	list_del ( &timer->list );
+	timer->start = 0;
 	timer->count++;
 
 	/* Back off the timeout value */