For testing purposes, I'd say wrap up all the stuff you'd like to do with user-supplied eval code into one sub (or module) and then just test that. Then you don't have to have tests for eight (or more) places in your code that uses it.

As for your list of things to check for, I'd say it's pretty complete except that the value returned from eval doesn't really mean much and the $EVAL_ERROR isn't very reliable.

To see why $EVAL_ERROR is not reliable, see Acme::ExceptionEater.

The value returned from eval doesn't mean much because the user-supplied code can make it whatever it wants. That's because return works inside eval just as if it were in a sub.

my $code_from_user = "return undef;";
my $success = eval "$code_from_user; 1";
# oops, $success looks like failure!
[download]

Update: If you want to catch a die that the user called vs. a die from a run-time error (such as division by zero), I think you'd have to override CORE::GLOBAL::die to report when it's called.