A couple of months ago I managed to make a mess of it all after I forgot to restore 'sources.list'. And a week later I made the same mistake once again. I guess I'm one of those who never learn.
I then wrote a couple of scripts that will make it easier to change repositories but also restore it automatically to a safe state.
I have two files, named '/etc/apt/sources.excito' and '/etc/apt/sources.debian', that will include excito only or also debian. My '/etc/apt/sources.list' is a symlink that will point at one of these files depending on what I need. A script named 'set_repo' takes 'debian' or 'excito' as argument and will redirect the link when needed. This makes it easy to swap repository. Now, as a protection against my own stupidity and bad memory, I have an hourly cron job that will examine '/etc/apt/sources.list' and detect active (uncommented) debian repositories. If one or more are found, it will restore the symlink to point at the excito-file. This script also detects if any one is logged on, and if so aborts, so that it doesn't try to restore the link when I am logged in and actually want it to point at debian.
It's not fool proof like your solution, but at least one will probably get the upgrade without problems even if file was edited. There is still a window of opportunity, after a file change until the cron job kicks in and sorts it out, for mr Murphy to destroy it all. Running the cron job more often will make that window smaller, but I think one hour is safe enough. At least I haven't manage to make a mess of it yet
/Johan