STM32 Bootloader: How to ensure only uncorrupted firmware boots
booting into an erased flash leads to lockup quickly


This may or may not happen - depending what was written and what was not. Note that depending on how the flash is updated and timing there might be no erased flash page - just some with new and some with old data.


  initial PC/SP [...]
  The critical window is now only the write of these two words


True, but there will still be a chance for failure - not good enough for safety critical applications.

Note that users might be tempted to use a standard STM32 flashing tool instead of your software - it would work just fine with ROM bootloader but defeats your migitations completely.


  Write a custom bootloader into Flash


I strongly recommend this approach if the results could be catastrophic in failure conditions.