Can I ensure keyboard commands don't get trapped by browser scripts?

The only surefire way to avoid having JavaScript trap keyboard input is to disable JavaScript in the browser.

I understand you'd like to leave JavaScript on, but it is designed to pass near total control of raw key presses to the browser and not to the app once the OS hands it input data. This means you would need a specific code solution for each implementation of keyboard filtering on potentially each individual page/site to ensure arbitrary key chords like Command H get sent to Safari instead of JavaScript.

See these links for an overview of how key presses are handled:

• http://www.w3.org/TR/DOM-Level-3-Events/#keys
• http://unixpapa.com/js/key.html
• http://unixpapa.com/js/testkey.html

The last link is a tester to show you the raw events and you will see that even a brief ⌘Q can be trapped by JavaScript if the website developer wishes to do so.