Defending Pre-trained Language Models from Adversarial Word Substitution Without Performance Sacrifice