Setting validation is now in trunk. See https://core.trac.wordpress.org/changeset/37476

The validation being done in Customize posts is using the proposed $strict param which didn't make it into the final patch. We need to implement validate callbacks, or return WP_Error from the settings' sanitize callbacks (but only if at least 4.6-alpha-r37476, aka if WP_Customize_Setting::validate() exists).