The following results in an infinite loop within Pacemaker:

<rule id="rule1">
  <rule id-ref="rule1"/>
</rule>

I don't know if a RelaxNG schema can prevent this, but Pacemaker should at least throw an error. Currently it segfaults on my machine.

Since rules can be arbitrarily nested, we should throw an error if a rule's id-ref resolves to any ancestor, not just the immediate parent.