STM32F407 fallback to Internal Osc
From the datasheet you link,

2.2.12 Clocks and startup
On reset the 16 MHz internal RC oscillator is selected as the default CPU clock. The
16 MHz internal RC oscillator is factory-trimmed to offer 1% accuracy over the full
temperature range. The application can then select as system clock either the RC oscillator
or an external 4-26 MHz clock source. This clock can be monitored for failure. If a failure is
detected, the system automatically switches back to the internal RC oscillator and a
software interrupt is generated (if enabled).

There is already hardware in the chip, and a system in place to do what you want.