How far is "too far off" for ntpd? Can it get there by a sudden jump to heavy load? Can this be overridden?

First off, the default max difference is 1000s as others have mentioned. As @kyle stated you can use the -g flag to ignore this ONE time only to initially set your clock.

After that you really shouldn't see your clock drifting by 1000s between updates even under highload, and if you do you really need to replace the clock. The settings in the configuration you need are minpoll and maxpoll. These will allow you to set the interval duration to the power of 2 (e.g. 10 means 2¹⁰ = 1024 s).

Please note that your system is likely not going to drift substantially even under high load, and the default settings should keep it in check. You don't want to bombard NTP servers with updates every second as you are wasting resources it will get you blocked and most likely a call to your ISP NOC. If you really need extremely accurate time use GPS or setup your own NTP server.

NTPD can adjust your clock in slow increments if it's off, clock slewing. The idea behind that is that slow steps won't cause issues with software timers, strange gaps in log files etc.

The maximum slew rate possible is limited to 500 parts-per-million (PPM) by the Unix kernel. As a result, the clock can take 2000s for each second the clock is outside the acceptable range.

According to the manual page ntpd won't work if your clock is more then 1000 seconds off.

Since slewing the clock to adjust it by 1000 seconds will take at least 3 weeks and during that time all date/timestamps are still off, that doesn't seem unreasonable.

The ntpdate command has a -b switch to simply adjust the time without slewing. This is useful in cases where the the local system clock deviates too much from the "correct" time.

This is specified in man ntpd, and you override it you might be interested in the -g option (Note the "which is 1000 s by default":

-g Normally, ntpd exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, ntpd will exit with a message to the system log. This option can be used with the -q and -x options. See the tinker command for other options.

You can adjust this in ntpd.conf. If you want to disable it you can set tinker panic 0. See the Miscellaneous Options documentation to learn more.