This commit makes the servo engine discard events where "one way
delay" is over one second (this will be documented).  The management
was never tested and likely wrong anyways.

It also ignores events where the trip time appears to be negative.  In
this case the calculation is brought forward with the current value
for one way delay (the current average).  This happens when the slave
is running a faster clock than the master during recovery.
Signed-off-by: Alessandro Rubini <rubini@gnudd.com>