How to make sure this oscillator will be stable?
The idea of the stabilization is as you wrote. The immediate decay problem doesn't exist if nothing can suddenly make the temperature of the filament higher. In properly designed generator the filament is insulated from the environment so that in usual environments the heating caused by the output signal surely makes the filament substantially hotter than the environment. Thus the environment cannot warm it, it only causes cooling which is in balance with the heating caused by the output signal.
The filament has thermal mass. It makes its response slow when compared to single pulses of the output signal. That makes very low distortion possible.
But as already said by others, the lamp detoriates gradually like incandescent lamps do so the output amplitude changes as the lamp gets older. And the ambient temperature affects the output amplitude because the needed output power for certain filament temperature depends on the temperature of the environment.
I guess (haven't tested) mechanical knocks also can be detected in the output signal.