The easiest thing that occurs to me would be a on-phone "message virus scanner" that self-updates and checks incoming messages against a threat database after decryption, but before passing them to the rest of the system.

Architecture-wise some thought should be given to keeping iOS from being DoS'd by the crash/respawn of any service.

Also, looking at the "assuming it's a string" line from the problem description, Apple needs to make an investment look through the codebase for this same error in other guises.

That's what occurs to me off the top of my head anyway.

Would it not be possible to detect malformed messages, and prevent them from being sent to a phone in the first place?

they can force-push emergency fixes