How do you define emptying the wallet? What if I have $500 and want to spend $200 of it? Also, a "saving" transaction might not work if the attacker pushed a higher fee tx to the miners. Even if they didn't push to the miners, if they broadcast a transaction stealing your entire wallet, then you would somehow have to make your "saving" transaction be put in a block instead of theirs which was broadcast first.
The simplest definition of emptying would be to transfer the entire contents, as it is what usually happens. However, if this began to be guarded against the attack would then likely come as several separate transactions to empty the wallet in pieces. The service could offer the option of defining what emptying would be (anything greater than XX BTC in one transaction or over a certain period of time, perhaps).
If you wanted to spend YY BTC and YY >= XX, then this is where the user would have to alert the service to whitelist the request, as described above. If it YY < XX, then you could just spend the amount without requiring any further action.
If the fee on the saving transaction needed to be higher to succeed, then this is where the user would need to create several transactions, with varying fees in order to combat this. Alternatively, the best solution would be if the miner would choose to accept a transaction broadcast by the service over another one, regardless of relative fees (a hacker could put 10 BTC in the transaction fee if that meant it would go through, while a user would never do that willingly for his own transaction).
- Is it possible to know that the transaction was broadcast by the service? If so, then with the acceptance by the mining community to prefer the “eject” transactions, the service becomes much more valuable and effective.