Unfortunately it turns out that the neat hack in commit
b227a8e4 does not work unless something
actually _deletes_ the current m_pTblCrsr between Push() and Pop(),
e.g. by calling SwCrsrShell::ClearMark() or KillPams().

It would be possible to do some invalidation of m_pTblCrsr in
SwCrsrShell::ClearUpCrsrs() or UpdateCrsr(), to set it's bChg flag
or perhaps call ParkTblCrsr(); not sure if doing that is an improvement;
certainly it shouldn't be tried in a 4.0.6 backport.

So work around the problem locally in SwTextShell::Execute().

Change-Id: I2981506b3065e824532deda28d21dad4a5734a8c