Do proper null-checks on decypted events to fix NPEs

[lukebarnard1]

Previously we assumed that a decrypted event has a room_id
but this isn't necessarily true for to_device events.

It makes sense to ignore events that aren't associated with
rooms anyway given that the list we're updating only contains
rooms!