Browser and OS vendors (Firefox, Chrome, Microsoft...) include CA certificates in their default "trusted CA store" under some stringent conditions about how the CA operates -- its Certification Practice Statement. The premise is that if a CA misbehaves, e.g. by being too easy to swindle into issuing forged certificates, then the browser/OS vendors will remove the CA from the default trusted CA store. And the browser/OS vendors will do that only if it fits their own interest, a concept which is best expressed in financial terms.
So the only thing you can do, really, is to keep your lawyer primed and ready to fire. If a CA misbehaves and issues a fake certificate for your domain, threaten the CA, and threaten the browser/OS vendors, who must, by necessity, be the ones who ensure the cleansing of default trust stores. Ultimately, it is all a question of market pressure. "Fear will keep the local systems in line."