Alternatively, allow everything in filenames, including whitespace and '/', but escape them on the filesystem using something like URL escaping (%20, %2F). No reason the filesystem names have to match the user-friendly names precisely, as long as a lossless bidirectional conversion exists.
Neat idea. If I understand correctly, it'd still be fair to say that those characters wouldn't be allowed in file names since encoding/decoding the friendly form would be opt-in work each and every userspace program couldn't be relied upon doing?