Only change to this comment I would make is: rather than an active/active master cluster, I'd have it active/hot standby (i.e. the VIP on the load balancer only directs connections to one master, and fails over to the other master if that one is unavailable rather than balancing connections between the two masters all the time, to avoid/minimize write conflicts).
Good point, I hadn't considered write conflicts. Active/passive of course won't provide you the read performance of active/active/LB, but I doubt that's really the concern here anyway.
John