EC2 instances in VPC and access to the Internet

Your approach sounds very good - but I can think of a possible way to improve it.

To reduce the impact of data loss since the last backup, and EBS volume failure (unlikely, but still possible) you could store your data on a separate EBS volume than your system files, and back up the data volume more frequently than the system volume.

With your current strategy, you'll lose any data that was created between the time of the last backup and the time your instance failed. With the new approach, the data volume will be getting written to right up until the instance failure, so you can just reattach it to your new instance once it's up and running.

In order for the 10.0.0.88 instance to access the Internet (or EC2) via the Internet Gateway (IGW), the instance either needs to have an associated Elastic IP Address or needs to be talking through a NAT instance (which has an Elastic IP Address).

To lock down an EC2 security group to allow traffic from the VPC instance, specify the allowed source as the Elastic IP Address from either the instance itself or the NAT instance, as discussed above (ex. 192.0.2.25/32).