nftables set refresh leaves stale IP entries

The firewall update appears to run, but some stale members stay active because the atomic update path failed halfway and the old set was never swapped cleanly.