I think this is somewhat achievable already by passing a different nunjucks env that only knows about a restricted subset of templates. The `catch` is just the "nunjucks has no idea what template you're talking about" case, so I don't think there are errors there we care about. I'll look over it again and see if it can be improved.