Update:  After re-reading the documentation, I see that what I originally suggested is wrong.  \xnn matches "the character whose numeric value is nn", where "nn" is a pair of hex digits.

I think that /\x/ will only guarantee you that you have 1 hex digit in your string, though won't work.  If you want to make sure there are exactly 2 hex digits, use something like:

-validatecommand => sub{$_[0] =~ /^[0-9a-f]{2}$/i},
[download]

The ^ matches the beginning of the line, the $ matches the end, and the {2} matches exactly 2 hex digits (0-9 or a-f).  The i at the end causes ignoring of case, of course.

Check perlre if you need to read up on regexes.  Good luck!