Backup switch (another float switch?) and alarm won't help if no one is around to hear it. It works if you're home.. or someone is home. The only sure-fire way to ensure your water doesn't turn into fresh water is to physically limit the size of the top off source. Well, one of the sure-fire ways. If someone can think of something better...
I use to hook my RO/DI straight into the auto top off as well. It's not good for your membrane either. The first few seconds of water coming out has quite a bit of TDS. It clears up after a few seconds of running.
I think you can program an AC3 to pulse. When I get one, I'll see what all if it can.
The backup switch also disables the pump, in addition to the alarm. In order to have the ATO flood the tank, you'd need to have two concurrent failures. Lets run the reliability calculations.
Given that I've run a floatswitch ATO for two years without a single failure, I think a highly conservative estimate would be for a maximum failure rate of one per year for any given floatswitch.
We'll use a mean time to repair (MTTR) of about eight hours on the first floatswitch failure, based on most people's typical activities - unless you travel for work on a regular basis, you're going to be home almost every day, at least once.
So, we have an expected unavailability on the main floatswitch of 8 hrs per year. The backup floatswitch is tested after each water change, or once a week. Based on that testing cycle, we can anticipate a maximum unavailability of 3.5 day per year.
Those two numbers are converted to 0.009589 years/year and 0.000913242 years/year. The failure rate for a concurrent failure of the floatswitches is approximately 0.000008757 years/year, which corresponds to one failure every 114,194 years.
Lets assume now that you're not a normal person, and you're only home once every week, at which time you change water and test the backup switch. The MTTR for your primary floatswitch is 3.5 days, as is your backup. The unavailability of each is 0.009589 years/year, and so the concurrent failure rate is 0.000091949 years/year, or approximately one failure every 10875 years.
That's reliable enough for critical safety equipment at a nuclear power plant. Ask me how I know.