My fear is that if the VPN connection is severed, you're locked out of your environment.

I typically have a public bastion and just shut it down. In AWS you aren't paying for it if it's turned off and you have an "escape hatch" if you need it.

If someone manages to launch another instance or start the stopped one then they would have access, but that's another can of worms.