**What do you think is the best approach?**
After realizing that Inject has a global `require` function, too, I think I'd recommend the following approach, coupled with basic escaping/validation:
> Require that their loader function is exposed as a top-level reference so that we could do
> `window[{amdLoaderName}](...)` instead of just `{amdLoaderName}(...)`.

The global `require` function _is_ [defined in the AMD spec](https://github.com/amdjs/amdjs-api/wiki/require), which is why all AMD loaders [except curl.js] name it `require`.  However, the AMD spec _also_ states that having a global `require` function is only optional for AMD loaders to implement:
> A global `require()` function is one that is available in the global scope, like `define()`. An implementation is not required to implement a global `require`, but if it does....


**Are we going to have to update for every AMD library that comes along? Which ones do we support and not support?**
These are non-issues if we go with the aforementioned approach. If we did go with the finite list, however, yes, we would theoretically be updating it for any users who use new/different AMD loaders and request that they be supported (though I don't anticipate any major uptake in the number of new AMD loaders being created).  They would be quick and easy changes but annoying all the same.  Moreover, though, I'd expect almost every new AMD loader to be exposing a global `require` function, which means no updating would be necessary so long as their users utilized that function (i.e. `require`) instead of the loader-specific version (e.g. `requirejs`, `Inject.require`, etc.).