First off, you don't have to be afraid to commit any configuration if you use "commit confirmed <time>". That command will allow you to put a number of minutes in before the commit is rolled back to the previous configuration if the config is not committed again within that time period (https://www.juniper.net/techpubs/en_US/junos10.3/topics/task/configuration/junos-cli-configuration-activating-after-confirming.html).
Second, if you are concerned about traffic rates and DoS/DDoS traffic hitting your routing engine, I would not use the 'reject' action - reject will send an ICMP 'port unreachable' back to the source IP which adds to the load and overall problem. I always use 'discard', which silently drops the packet.
Third, remember that this filter is applied to the loopback, which means it handles ALL traffic to the RE. SSH is not the only traffic you want to see hit your loopback. For instance, this is a sample of what I might allow on my routers in the loopback filter:
tcp-established traffic
SNMP
NTP
DNS
BGP
traceroute ports
LDP
RSVP
VRRP
ICMP echo-request/echo-response
Then we would 'discard' and log all other traffic.
If, in fact, all you wanted was to allow BGP and SSH, this is how you could construct your filter:
set policy-options prefix-list aa apply-path "protocols bgp group <*> neighbor <*>"
set term ssh-filter from 192.168.1.0/24
set term ssh-filter from 13.16.2.0/24
set term ssh-filter from protocol tcp
set term ssh-filter from destination-port ssh
set term ssh-filter then accept
set term bgp-filter from prefix-list bgp-peers
set term bgp-filter from protocol tcp
set term bgp-filter from port bgp
set term bgp-filter then accept
set term discard-the-rest then discard
Again, this is a rule that ONLY allows the above traffic and nothing else. You need to make sure that you don't have other protocols or services running on your router. One way you can check and see what is currently running is to look at the system connections (in operational mode, not config mode):
show system connections
Doing so will help you understand what else is currently running on the router and build a good RE protection filter from that information.
And, as I said, don't forget to use the 'commit confirmed 2' command, which will roll back the configuration automatically if the config is not committed again within 2 minutes. You can set the '2' to any time period you like, such as '5' minutes or '1' minute. Just remember to commit the configuration before the timer runs out if you are satisfied your change are working.