I wonder if the BOUND instruction could have been used to call int 21h more than once.
That would have the same problem that after return the BOUND instruction would be re-executed, but perhaps there are useful DOS calls that after execution modify the registers such that the bounds check wouldn't fail afterwards.
You can put the bounds immediately below the current stack pointer. Since the code runs in real mode, there is no separate "kernel stack", and any interrupt will overwrite the values with flags+CS+IP, which you have some control over.
That would have the same problem that after return the BOUND instruction would be re-executed, but perhaps there are useful DOS calls that after execution modify the registers such that the bounds check wouldn't fail afterwards.