I was babbling away on facebook about how the shutter end switches would be better handled in electrical hardware than in software and realized it should be here so it doesn't scroll away in a day.
Anyway, with some extra thought a typical electric motor start/stop circuit would work for the shutter end switches and provide a fault detection way of making sure you never try to push past the stop position.
Here's a quicky schematic of a typical start/stop circuit (the relay would be normally open but Diptrace doesn't seem to have NO in its basic symbols).
K2.1 is the relay coil and when energized it closes the switch K2.2
Pressing the start button (normally open) applies power to the coil, closing K2.1 which lets power flow to the motor. The stop button gets power when K2.2 is closed and being normally closed that power goes to the coil.
When the start button is released the coil remains energized because the stop circuit provides power to it.
Pressing the stop button opens the circuit and no power gets to the coil so K2.2 opens. When the stop button is released the coil remains deenergized since there is no power coming out of K2.2.
For the shutter to work in both directions the circuit has to be somewhat different (which I'll figure out and post later) but basically the start button would be a relay or transistor and the stop button would be an end switch.
With this kind of setup it's pretty much impossible to drive the shutter past it's end switches. If the end switch wiring is cut or unplugged then only by holding start closed could it ever drive past the end switch (e.g. on purpose). Actually, just realized I could connect Start.C2 to a point before Stop.C2 and then it wouldn't be possible to drive past the end switch on purpose either. Broken or missing end switch connection would mean no movement at all.