I'm surprised that the IBEC didn't kill the ignition when no valid signal from the receiver was present, or was the receiver failsafe also not set to kill the ignition? With an opto kill, or IBEC of any kind, if the receiver goes into failsafe, but that channel is set to "hold last good position" you're screwed
I do like the fact that with an IBEC, if you actually lose power to the receiver, the engine will quit without a doubt. This is the one scenario where receiver failsafes won't kick in, and even a throttle return spring will probably not be able to drive the servo to the idle position.
For my money, a good throttle setup is always a top priority, as MetallicaJunkie put it so well. Follow that up with making sure your receiver failsafes are correctly set, and use an opto kill or IBEC to be able to kill the motor via the radio. Nothing is ever fool proof, but I think that these three items will go a long way to covering all the bases.
Pete