For this application I'd second what Yanche says ... use a temperature controller.
A temperature controller is more complex than a bimetallic thermostat, but gives a lot more flexibility. Once you buy a particular thermostat, you are stuck with it's characteristic trip temperature and hysteresis, but these are completely under your control with a temperature controller. Although a type J thermocouple will work I'd use a type K instead - iron in the type J TC is prone to corrosion in this application. It doesn't necessarily need to be in the flue gas stream; for this service it would do to simply clamp it to the outside of the flue pipe using a large diameter hose clamp.
AutomationDirect sells the 'Solo' series of controllers which combine a good feature set and low cost (the SL4848-RR at $99.00 would work). You may find equivalent controllers on eBay for less, but will need to do a bit more research to make sure they fit your needs.
This one also has MODBUS over RS485 serial communications capability, and opens the possibility of logging temperatures to a computer using any MODBUS capable client, or their free configuration/recording software (although you'll need an RS-232-to-485 converter as well). http://support.automationdirect.com/products/solo.html
Solo SL4848 Product Overview http://web2.automationdirect.com/adc/Sh ... /SL4848-RRManual Note: I can't get the product overview link to display correctly as a hyperlink, but you can copy the text between the bracketed URL indicators, and paste it into your brower's address bar.
In this type of circuit the controller output isn't used for temperature control, but rather simply as a limit indicator using a relay output that changes state when setpoint has been reached. The controller would be set up for on-off control (rather than PID). Typically you can get up to two alarm outputs as well on such controllers, although the SL4848-RR looks like it has only one.
Alarms can be set up in a variety of ways, but one that may be useful is 'high absolute limit', and use it to turn off the burner if the stack temperature gets uncomfortably high. In implemented, you'd want to set a rather wide hysteresis for this - a small hysteresis would allow short cycling. For instance, if the stack overtemp setpoint was 200°F, and you used a hysteresis of 1° then the burner would turn on again at 199° ... not a good idea. Here an alarm hysteresis of 50°F would make more sense.
I measured the temperature of my flue pipe 1/2 way between the boiler chimney outlet and damper, and got the following temperature curve - starting at 99°F, a rise of about 15°F per minute until it started to settle out and 'knee over' at 162°F about 4 minutes afterward.
Whether you use a thermostat or controller it seems you'd need a bit of timing and hold in logic, too, something along this line ... [if burner is on for more than x amount of time, and flue temperature is less than y degrees, then "fire out" - turn off burner, sound alarm, and lock out burner until reset]. In this case I'd probably use a 2 minute burner on time, and figure for a flue temp of 120 degrees. If the burner has been running for more than 2 minutes, and temperature hasn't reached 120 degrees then the "fire out" condition would be satisfied, and burner would be locked out until reset.
This would miss a fire out condition until a demand call occurs (i.e. - a 'keep lit' timed running of the burner wouldn't trigger it, since the burner wouldn't be running for long enough), but this won't waste too much unburned coal.