e.g. if you have a loop and want to put the protection outside around it rather than on each call.

Perhaps unwind_protect() should set a global flag, then we know that we don't need to unwind protect again?