Why do MCU crystal oscillators not fry the crystals?
If it is really that hard to gauge correctly, why don't manufacturers
  provide better guidance?


Oscillator designers have a tough job accommodating resonators over a very wide frequency range, and whose power-handling might range from fractions-of-microwatts to milliwatts.


The oscillator driver runs in its linear region - a no-no for digital CMOS devices. It may consume significant DC power if its drive strength is large, so CMOS designers are urged to make these devices as feeble as possible, and still oscillate at their high-frequency end, yet still oscillate with low-Z crystals.
On top of that, the oscillator inverter might be powered by Vdd that can vary.
And on top of that, the end-designer might have more software skills than electrical engineering skills.


In designing the oscillator, one usually errs on the side of over-driving the crystal, because an oscillator that doesn't oscillate is useless, while an overdriven oscillator gives a desired output - perhaps squirrelly, but at least of the desired form (AC rather than DC). A marginally-driven crystal may start up too slowly, causing problems downstream...an overdriven oscillator builds oscillation more promptly.


  Is the output resistance of the inverter sufficient? How can one
  design for this, other than trial and error?


Few inverter spec sheets include \$r_o , g_{fs}\$ that may help tell if oscillations will start. For CMOS inverters, \$r_o\$ is inversely dependent on Vdd, while \$g_{fs}\$ is directly depenedent on Vdd.

from NXP 74HCU04 data sheet
 Crystal manufacturers help guide us by specifying load capacitance for their crystals. When a parallel resonant crystal is loaded with this capacitance, and driven with the few volts available from an inverter, crystal current flows roughly in the right ballpark. An added series resistor could be used to adjust drive strength and/or start-up time.
At high frequency, it is recommended that any added series resistor be replaced by a capacitor, whose value is between 0.5X load capacitance, and 1X load capacitance. Especially for 3rd overtone crystals

A good design might run the oscillator much closer to the "starve" point, versus the over-driven point. But doing so risks no oscillation.