There's a part of me that believes that on startup, a service must check the config and bail out immediately if it's invalid.

If it doesn't do this automatically, there's still the option of adding the configtest in the ExecStartPre option.