I'm not sure how using an unsigned number would help, given that when it overflows you're still going to have some code do unexpected stuff anyway.
For another, that's why you get paranoid.
(For a third, I strongly recommend something like Frama-C with the Weakest-Precondition module---it's very good at finding issues like these.)
It's also much easier, IMO, to accidentally underflow an unsigned integer; it's so much more common to work with 0 than it is to work with +/- 2 billion.