[PATCH 4/7] user16: Use NtUserDispatchCallback instead of User16ThunkLock.