Is there a way to get Postfix to guarantee durability in its receipt of email?
E.g., can it be sure to fsync the mbox/Maildir file and/or directory before it acknowledges successful receipt of an email?
Do you have reason to believe that you have a problem here?
Although (unlike most MTAs) postfix can handle delivery itself, but this is a very unusual setup - more typically its passed to the 'local' program. My own preference is for procmail which provides very complex scripting abilities.
At each hop, the MDA will not acknowledge receipt until it has queued the message locally. Sure that may mean that the file is not on the disk at this point - but SMTP is not transactionally secure to begin with - if your losing messages because your server keeps crashing then this is not the way to fix the problem.
It's up to the MDA to refuse to accept the mail or deal with failure after it has accepted it.
You really need to establish if, and where that messages are getting lost after your system has acknowledged receipt. This may be a lot easier if you use a more complex MDA to log or duplicate delivery.