> and trust it, I guess.

Exactly. Best you can do is audit, dry-run with offline computer, then trust.

> You could “roll” random 1-2048 23 times, and then roll 1-8 for final word. Do I have that right?

Correct. ColdCard, Keystone (formerly Cobo Vault), SeedSigner and Spetre DIY will show you the list of conforming last words, from which you can pick. There may be other devices, I don’t know.