I don't know about diabetes and insulin specifically, but what constitutes a fatal dose might not be easily calculable up-front.

Obviously, there'll be a dose that will be deadly in all cases - the LD100. But the statistical "half the people given this dose" LD50 measure could easily vary by ± 100% or more. Things like metabolic rate, body-weight, route of administration, insulin tolerance, and relative blood-sugar levels could all factor into the dosing system, and I'm guessing the whole point of having it remotely configurable is to minimise the processing effort on the embedded chunk.

If the hacker could bypass the software on board and directly control the pumps, then no sanity check would help.