That's a real worry that the phones don't reboot. I assume they are something different to Cisco which reboots if it loses comms to the call manager?
Well, ideal number 1 from me...
Nail up a static GRE between the controllers, and align it with a specific VLAN (where your phones will live). This means regardless of where the phones terminate, they live in a routed "cloud" VLAN shared between controllers and resilience will be fine.
Then, make sure the layer 3 egress point from both controllers suits the routed infrastructure, maybe using OSPF to make it optimised and resilient? I haven't thought this through in detail, and it might not suit your layer 3 topology, but it's an idea at least?
Also have a sensible think about where the DHCP is going to come from resiliently of course.