unbound-checkconf on the generated file before the reload would catch the worst of it.