What is the "correct" way of reporting problems detected by sanity checks, or catching exceptions?
In core Drupal try-catch blocks are pretty rare, because code is consistent, and core (boldly) assumes that code in contrib and custom modules will be good, too. One core function simply won't send malformed data (like non-objects where object is expected) to another - and won't expect another code to send inconsistent data to it. So try-catch would only slow things down. On the database side, and on the user input side, checks are performed all right. This, of course, is by far most recommended approach. If you can make sure your data is coherent, do it. Don't call Entity API at all if you haven't ensure you will not cause EntityMalformedException.

The only place it's not possible is a border between Drupal and other systems (including database and http connection). There, you need to put safeguards up. Your points are correct then, but you need to add one more:


Call watchdog
Set message for admin
Tell your user that what he think he did might have not happened. For example, if your code failed to delete a photo user really, really need to have taken down and you won't tell him, he may be disappointed. In some situation, you may also find yourself in legal trouble.
And only now proceed