>         Finally, CLRWDT should NOT be put in an interrupt service routine
> since sometimes the main program can crash, but interrupts keep running
> fine.

Putting a CLRWDT in an ISR is not necessarily bad, provided that it does
some checking to ensure that the main loop is in fact alive.  For example:

MainLoop:
        bsf     ImOkFlag
        bcf     NotOkFlag

        ...
        goto    MainLoop

Interrupt:
        btfsc   ImOkFlag
         btfss  NotOkFlag
         goto   NoDoggie
        clrwdt
NoDoggie:
        bcf     ImOkFlag
        bsf     NotOkFlag
        ...
        retfie

The two flags may be set in different parts of the code; your interrupt
handler may also do some "faster" watchdogging of its own.  For example, if
your inner loop should run at least once every interrupt, you could do:

Interrupt:
        btfss   ImOkFlag
         goto   Oops
        ...
Oops:
        movlw   0
        option          ; Set minimum watchdog time
        goto    $       ; Wait for watchdog

In this case, you could use a fairly slow timeout on your outer loop and still
tell quickly if your inner loop failed.  Alternatively, you could do something
like:

MainLoop:
        clrf    OopsTime
        ...
        goto    MainLoop

Interrupt:
        ...
        clrwdt
        decfsz  OopsTime
         retfie
        movlw   0
        option
        goto    $

In this case, your interrupt would keep the watchdog happy as long as the
interrupt was running happily, but if the main loop died for 256 interrupt
times the system would restart.