Tips for making a codeable ui?

Safest way that exists is to write your own parser. Other than that the more dynamic you choose to go the more room you open up for threat actors to take advantage of it.