I got a bit further to these few lines.  Not quite ready yet, but
getting closer.  The byte-compile-check-var is more or less a break-out
of the checks in byte-compile-variable-ref.

add-hook and remove-hook end up with checks against non-variables, but
they don't demand a bound variable.  I suppose they could helpfully also
notice undefined functions in their second arg too.  You'd be tempted to
have some sort of general arg-type description for the builtin funcs
rather than doing checks plus "normal-call" for each.