One of my colleagues recently built a circuit that had exactly the
problem you're worried about, although I suspect it was on power-up, now
power-down (we're not really sure - all we know is that if you turn it on
and off a few times, the EEPROM got trashed).  This was also one of the
major problems with early EEPROM's before they invented the multiple
cycle write lockouts and voltage detector lockouts.

If someone were to turn off the power to your device, then turn it back
on at the precise moment when the power supply rail reached 2.0V, you'd
have a PIC that would not reset and would not power up correctly either.
The program counter could point anywhere, including at the code that
writes the E^2.  No matter how fast you drain those caps, a momentary
power loss can hurt you bad.

The point is that if you have EEPROM and code that changes it, you must
be very sure not to allow that code to run if you don't want it to.  That
means using a highly effective brownout detector.  I'd recommend reading
the data book.  They discuss several methods.  M'Chip also now makes
voltage detectors that could help.  So do about 10 other companies, so
they're not expensive.

                                Don