Joe stole my comment about using Jags.
Anyway, as much as I like to rag on the software guys, Limit switch failures are almost always mechanical & how they actually stop the motor is not the issue.
Anything that requires double protection like you are suggesting, you want to separate the modes of operation as much as practical. Like using a feedback pot for normal posting & limit switch through a jag for the end points.