Having a two-tiered limiter won't solve anything. It's a little more complicated considering that I/O throughput changes given the circumstances.
If a single thread read can sustain 50MB/sec, then two threads can only achieve 25MB/sec. Considering that they are likely reading from different parts of the disk, you have to calculate in the access times, so suddenly two threads only achieve 20MB/sec each. Multiple that by many threads (read: Linodes) and suddenly throughput can be in the K/sec range. Yeah, RAID-1 can read from both disks independently, but you get the point.
There's no point in limiting the I/O of a Linode if the host is sitting there idle, just because they've run out of tokens. What I really need to do is factor in a few variables into an I/O watch-dog that dynamically changes the
io_token_refill and
io_token_max rates depending on a few factors. At that point, the refill rates and the bucket size values would equal, turning the limiter into a rate-limiter rather than a token-bucket.
The ideal situation is that the limiter is set with sky-high values, and only buckles down when it's time to share or a Linode is behaving badly.
The variables would be something like:

The current load of the host server itself, measured by how many processes are waiting for I/O

The amount of swap usage for each Linode should factor in as a penalty. I have seen Linodes who have a lot in swap but don't thrash, but more often than not they're the ones causing high I/O.

The I/O usage history of each Linode, over a specified amount of time. This would prevent Linodes from being I/O limited who occasionally use lots of I/O during normal operation, say during untarring a large file. This variable would also help negate the fore-mentioned swap penalty, for those that have lots in swap but don't thrash.
My goals are that swap-thrashing Linodes are given lower-throughput values automatically, to eliminate the useless limiting of good behaving Linodes, and to always have a small supply of I/O bandwidth available for the host itself.
-Chris