See D13040. We have an "enum" type for configuration, but don't validate it during setup or repair it to the default value. This means that users can set it to bogus values fairly easily. Instead, we could detect/repair it during setup checks, like we do with some other configuration.