Call kill() only once when triggered by a temperature error

to avoid stack overflow when called from interrupt.

Some clean up for calls of disable_all_heaters().
'disable_all_heaters()' is called in kill() and again when 'killed' is already set inside _temp_error().