Your code setpoints should not allow for an overcorrection.
Unfortunately in the real world, there's sometimes a disasterous difference between "should not" and "does not"