Closing the Loop on Runtime Monitors with Fallback-Safe MPC