boost converter with overvoltage protected output
First, keep in mind that nothing is completely safe.  All you can do is decrease the probability of a failure causing additional damage.  You can protect against failure of specific components, but that introduces other components.  The failure of those can't usually be guaranteed to be harmless.

You should also consider the cost of failure times the probability of failure, versus the fixed cost in every unit of protecting against the failure.  For example, if the failure blows up $10 of parts and might occur in 1 out of every 100,000 units during their lifetime, then adding $1 of parts to protect against the failure is bad economics.  If, on the other hand, a failure means a $500,000 house catches fire, with the possibility to kill people, then rather more than $1 is justified.

You haven't given us any guidance where in the spectrum of failure cost your product fits.  Proper protection against the boost converter over-voltage is therefore impossible to judge.

However, given no other information, and taking on face value that over-voltage is worth a dollar or two to protect against, I suggest a shunt circuit.  This circuit draws all available current when the voltage gets above some threshold.  That's basically what a Zener diode does, but those can't usually dissipate the required power.  There are such things as power Zeners.  Look around.

A easier way to make a high-current shunt is usually with a Zener turning on a transistor.  The Zener does the voltage detection, and the transistor does the heavy lifting of handling most of the current:



You have to look carefully at power dissipation.  Find what maximum current the boost regulator can deliver at 7 V output, and then make sure the Zener/transistor combination can dissipate that power.  For example, let's say the maximum is 200 mA at 7 V.  That comes out to 1.4 W.  That's enough that a single transistor in TO-220 package probably needs at least some heat sink.  That will cost space and money.  Protection isn't free, which is why the tradeoffs should be carefully analyzed.