Customer's right. Bank's wrong, so far. A stop payment worked fine for lost check books (new checks here) back in the day when banks physically inspected checks. Now, banks pay based on the MICR line. As a risk management technique, the stop payment is a little silly - there is no assurance that the thief did not use one of the new checks as a "breeder document" and buy 200 more checks outside the range of check numbers fed into your computer.
Don't count on a judge enforcing a "hold harmless" agreement if you keep the account open. She will say you knowingly overreached the consumer when you supplied the document; you understood the risks and the consumer did not. (Obviously he didn't, who would agree to be responsible for forgeries of his signature?)
Going forward, all of the risk from leaving the account open is yours. If the customer refuses to close the account, your bank needs to close it for him. Make it up to him as best as you can, but, as you know, some mistakes can cause the bank to lose a good customer.
In the future, when checks are lost or stolen, close the account, no exceptions. As Guitar Dude suggests, you are still going to be stuck reviewing items coming in on the old account and either posting them to the new account or returning them for a reason other than "account closed."
_________________________
In this world you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant.