There is another option here, which would be to use the subtree_of? method to test the oid to see if it is under either the id-ce

id-ce   OBJECT IDENTIFIER ::=  { joint-iso-ccitt(2) ds(5) 29 }

arc or the id-pe arc

id-pkix  OBJECT IDENTIFIER  ::=
               { iso(1) identified-organization(3) dod(6) internet(1)
                       security(5) mechanisms(5) pkix(7) }

id-pe  OBJECT IDENTIFIER  ::=  { id-pkix 1 }

Use the ExtensionFactory if so, create a new extension if not, and catch ExtensionError for truly exceptional cases.  The grey area here would be standard extensions which the openssl implementation does not have encodings for...