Practice makes perfect.
Like Zoredache said, keep trying until you can do the routing diagnosis in your head before throwing the switch. Preferably on a box you have physical (or IPMI, remote KVM, etc.) access to so that when (not if) you screw up you can fix the problem.
Other free advice:
Whenever you're doing something that can affect routing or firewall configuration, DON'T set it up so it takes effect across reboots, and set a watchdog.
Something as simple as
shutdown -r +5 before you pull the trigger will ensure that if you lock yourself out your system will reboot and be accessible again. And if everything works you can just cancel the shutdown.
(I've been doing this for a good long while. I'm pretty good at it and haven't broken things in recent memory. I still set a watchdog before I touch a firewall or VPN configuration.)