Afaik the data is delayed and the damage might already be done by the time the alarm fires

For just running instances, that's not true. You set up a metric that checks if the instance is alive every minute, ten minutes, whatever, and set it's alarm condition to trigger once the metric is true for six samples, 600 samples, whatever you need. The alarm action: stop instance.