TBH, I think you're pretty well covered with the thermostat and the back up safety cut-out. Any additional safety cut-out you add would need to be as least as well-proven as the certified one in the immersion to be useful, I think. I can only once recall having an immersion "run away" and boil a tank, and that was over 40 years ago, before they were fitted with safety over-temperature cut outs. My experience since has been that, if anything, the safety cut-outs tend to operate when there isn't really a problem, as they seem to err on the side of being safe.