recovery: Clean up browse_directory().

Get rid of the malloc/realloc/free'd menus.

browse_directory() will only be called on devices with SD card. Tested
the CL by temporarily setting SDCARD_ROOT to a different location.

Test: See above.
Change-Id: I935e1bf4bad0273e3dff87fa2536924f1219adb5