Why recovery is bounded
Recovery that never stops is a loop. The bound is a number of tokens skipped, and the number is written.
The error is part of the contract
A bad program must answer. The answer is the contract, and the contract is checked by a test like every other answer.