It was important for this to a be a drop-in replacement for the original mechanical thermostat.
It was also important for it to be safe(ish) with at least one thermal overrun protection that isn't electronic. So I've designed a board that is essentially a relay driver adapter that the 1821 can control with a terminal block for connecting a thermal fuse. The first version looked this like:
The measuring tube in the tank turned out to actually be really narrow so I had to throw out that chrome rod and use smaller wire for the thermal fuse. It doesn't look as nice or tidy now but it fits. Here's a test fitting with the thick wire still and no fuse at the end:
The relay is an 8A DPDT. I was unsure about the reliability of the 1821 at higher temperatures so at first I've built an ATTiny13 based "debugger" that reported the temperature and the config register to a PC that I checked on from time to time. It seemed stable enough so I've been using this for a few days now and water temperature is pretty much constant :)
Board Eagle here
R6 - 2.2k
R8 - 10k
The board requires 5v and 12v DC and the AC for the water heater. Currently I'm using an external power supply in a modified wall adapter box.
Notes on soldering thermal fuses:
For a project like this a 98C or 104C SEFUSE or ThermoDisc G4 works nicely. They're small (size of a larger resistor) and can do 10A. They should be cooled (spray from some alcohol-based cleaner should do) and their leads held in a clamp or larger pair of pliers while soldering to keep them from reaching their cutoff point. Being quick also helps.
UPDATE: Safety modification
I've reencountered the problem that initially prompted me to build the ATTINY based debugging board. Apparently the 1821 can fail to enter thermostat mode when powering up.
Maybe it has to do with noise on the PSU during the initial stages of powerup and connection to mains that may be erroneously triggering Sensor-mode reset. I have no oscilloscope to see what's going on but the end result is that If the sensor fails to enter thermostat mode the boiler will overheat. Which is decidedly not a good thing. I can't reliably reproduce the problem but I'm going to assume that it's uninfluenced by the POL register and just basically makes the thermostat output stick at logic high. I've added an inverter and changed POL to 1. This way the 1821 is logic high once the upper threshold is reached, which is inverted to 0 turning off the heater. If it decides not to start up correctly sticking at logic high it just won't start heating.
The above modification seems to have fixed the issue. I've had no problems with the system since.