So, if anyone can offer robust methods to prevent this from happening (other than "don't let your code do that") I am all ears.
there is no such thing short of using a device with less than 64k flash and having the bootloader in external ROM. That, however will not be totally 'bullrtproof' since the reset vector will be in flash.
What I do, (using SILabs devices) is to have an 'emergency' JTAG connector on the board. I guess Atmeel (that I would never use) has a "pull this low, pull this high" means of kicking the uC into ISP and a means of doing so would also provide an 'emergency method'.
the obvious answer would be: "do not write errant firmwarer" :) ESPECIALLY for medical devices.

ABOVE ALL use a quality supervisor.

Micro 1:
~0.5 MIPS, >18 IO, internal EEPROM, 5V IO, ISP with bootloader protection
sounds like a NXP P89V51Rx2

Micro 2:
>4.5 MIPS, >32 IO, internal EEPROM, 5V IO, ISP with bootloader protection, 64k FLASH.
looking for speed I would abandon the 5V and go for a SILabs device (the pins ARE '5V tolerant")

Essentially I'm looking for the Atmel micros
WHY?

Ereik