Could you confirm whether you expect the drivers to be strictly robust against these kind of edge cases (input received on invalid windows, during their destruction), or if it is alright to be more lax and rely on `hwnd` being validated at some point, assuming it doesn't cause any problems in the general case?
In general, the right way is to handle things that affect a window in the thread that owns the window, then no locking is necessary. That happens automatically for anything triggered by a window message. For other things, usually we send an internal message to switch processing to the right thread.
If you are accessing the window from a different thread, then of course proper locking is needed. If you have to do that a lot, it's probably a sign that the design is wrong though.