A fix stopped one timer from being overwritten without a cancel, but its twin on the opposite event kept the same flaw. A stray second event still left an old timer alive, and it shut a menu under the pointer.
Fix the whole pair when one handler leaks a timer. Its mirror handler has the same shape.
Cancel before you re-arm. One pending timer per job, never two.
Cancel before you re-arm. One pending timer per job, never two.