Oh, I thought the two-step confirmation (Shutdown → Confirm) would prevent this, but apparently it’s still too easy to hit by accident.
Thanks for the suggestion! I’ll try changing it to a hold-to-shutdown action. That sounds much safer than the current approach.