Safety is good. Having done dozens of multi-stage flights, I can offer the following advice...
First, start thinking about safety when you first start the rocket design. It is a lot easier to design in safety at the start than to try to make a design safe after it is built.
Second, it is real important to figure out how to have the sustainer motor not light until you want it to. Three tips here:
1. Use an altimeter that incorporates an altitude check and not just a timer. There are somewhere around a half-dozen altimeters that can do this. They can help keep the sustainer motor from firing on the pad. And, they can prevent the sustainer motor from firing if the flight is not nominal. Programming the altitude check is not quite as easy as some people think, though, and it is easy to get it wrong. I could provide several examples from my own experience, but my recommendations are to make sure that you understand exactly how your electronics work and to have your setup and underlying simulation reviewed by someone who has done it before.
2. Use switches to shunt and/or short your igniter leads. I always use a shunt (to short the output leads), and in many cases I also use a short (disconnecting one of the leads on the igniter-side of the shunt). It is important to recognize that a shunt still allows current to pass through the igniter if the electronics fire. The purpose of the shunt is to reduce that current to below the level that fires the igniter. The current that will pass through the igniter is a function of many things, including the relative wire lengths and gauges, the igniter characteristics, the altimeter design and the type of battery that is used. Be very careful about using a LiPo to fire the sustainer if you are using a shunt, and if you don't understand why these variables are important, then ask questions.
3. Do an all-up test of the electronics (ideally) just before setting the rocket on the pad. All of my designs are configured so that I can do an all-up test. In the all-up test, everything is assembled and everything is turned on just as it will be when you arm the rocket, except that the igniter is not inside the motor. This is pretty much your last line of defense against a malfunction. If the all-up test passes, you turn things off, insert the igniter and put the rocket on the pad. There are many design features you might implement in staging that could make the all-up test harder to perform, including many things discussed in this thread. However, if you consider those features in the initial design, you might be able to build in a way to conduct the all-up test when the time comes. My personal rule, though, is that if some aspect of a design would prevent an all-up test, I won't do it.
Finally, I would recommend keeping others away from the pad when it comes time to arm the sustainer. No one has ever actually witnessed me arming a sustainer from closer than a hundred feet or so, and for flights with larger motors, it is further than that.
Jim
