Unless instructed to by me, my robot driver should never leave the road unless it is to save me, not kill me. The decision should be to drive the car into the area that causes the occupants the least harm.
Put it another way: this is one of those very rare occasion where collective cooperation (a la prisoner's dilemma) is possible. Shouldn't that... be the thing we want?
You being able to make a decision about the way your autonomous vehicle behaves which could result in a greater risk to other drivers is no different than the risk you present anyway just by having access to a steering wheel, and making the equivalent decision directly. Changing the radio isn't going to kill anybody, but letting you decide the ethics of your car just might. What happens when two cars with conflicting driver-set ethical subroutines come into contact? Do they debate? It doesn't work unless there's a single standard.
I'm not saying we should be able to rewrite the code. But a single user option like "Should I sacrifice your life to save another? [Yes/No]" just means the decision tree has another branch point that still leads to the same set of possible actions. It can still make better decisions about driving than the human driver because it still has the access to more information and more accurate controls. Deciding to crash me into a tunnel wall to save a child is not really about "driving safely."
If you answer yes to this question, aside from being a scumbag, if it does actually lead to an action taken by the car, you could face execution (worst possible case, granted, but there's a minimum prison sentence too).
Plus, this would hardly be the first way for cars to kill you. Brakes can fail, the steering column can fail, the gas tank can fail. All these things are rare, but certainly not impossible, and quite likely to kill or at least injure you.