So, I started working on this, and one thing that I remembered is that keeping this validation close to the SQL seems like it makes it easier to prevent injection attacks.  If I move the validation logic elsewhere, and then someone ever calls "paged-query-to-vec" without calling the validation first, then the process of building up the ORDER BY clause entails more risk of an injection attack.  I suppose that using parameters in the SQL string itself would alleviate this, though...