http://www.dunsleyheat.co.uk/neutralizer%20layouts.html
My system is a variation on this. The installation instructions provided with the Dunsley offer, or did when I bought mine, far more options. It has been working for the last 10 years untouched!
Footprint of 100 square feet? Mine sits in a cupboard with a floor area of less than 2 x 4 feet and that includes the header tank, HWC, Dunsley, pumps, controls, and gas boiler! My solar heating is connected to a coil in the HWC which, had I ordered a Dunsley with enough tappings, would have fed directly into that. Sometimes the water is too hot.
Gravity circulation is God. It is the only safe way to disperse heat. Even my solar is gravity fed so that if I have a pump failure it really wouldn't affect it.
If you must continue down the route you are considering, and who am I to say you shouldn't, think about adding a 50 gallon drum of water above your rocket - open vented - that can gravity feed heat away just in case. If you use a normally open motorised valve your power supply will keep it shut off until the power goes off. You could add a pipe stat to the flow side of the heat exchanger to release the valve if the primary water starts to overheat in normal operating conditions. This tank of cold water will give you ample time to allow your Rocket to burn down. My other thought is if you want to use pipe as a heat exchanger keep it short to lower the water content, but increase the surface area with multiple metal fins. It is far easier to control half a gallon of water that wants to boil than 10 gallons.
It is far better to build in more safety features than you need at the start. If they prove to be unnecessary the option exists to remove them. If they are not there you may not have the option to put them in!
A question for those who might know: Would a CO2 fire extinguisher coupled to a sealing plate for the feed tube be successful in shutting down the fire rapidly?