Emacs already restricts what variables can be set as file-local. It will prompt you to ask what to do if you open a file containing:

  ;; -*- eval: (message "arbitrary code") -*-

any mode associated with a file extension should be at least as secure against code execution.