What's the appropriate place to add additional validity checks for transactions? (check_tx_inputs?, does every tx pass through this, including during reorgs and such?)
This is a good place, yes. This is called before a transaction is accepted, except when running
monero-blockchain-import with verifiction turned off (which you should not do unless you exported the file yourself).