Why use an external pull-up resistor?

the limit should be designed to some 100uA.

While I quite agree this looks reasonable is there anything from the manufacturer to back this up? Data sheets application note or such like.

I have been looking through some articles... there is hardly anything quantitative about protection in high integrated circuits, just fundamental principles :-)

"Rules" and guidelines for low (!) integration circuits as opamps say: max 2mA, and when using external diodes: max 5mA.

In those cases however there is a much better distribution of dissipated heat...

I generally stick within 500uA to 2mA, with no problems during the last years... As I said, much depends on whther it is meant for - a permanent situation - 10% pulses - an exception (safety belt)

The problem is neither voltage nor current but locally dissipated heat.

Although I found that quote in an application note it was only that, a comment in an application note, it was not a number in a data sheet. Therefore it carries much less weight. I happen to be sat next to an ex chip designer and asked him about it. The answer, as expected, was that it depends. Basically the larger the diode capacity the greater the capacitance and so there is a limit on the frequency response on that pin. The other thing is that these diodes are designed to protect against transients, that is sharp pulses of electrostatic discharge. They are not designed for continuous dissipation.

There was some suggestion that there was no point in having external diode rail clamping as the internal diodes would switch on first. This demonstrates that the proponents do not understand diode characteristics as some degree of current sharing will take place.

Perhaps the best form of protection is a 5v1 zener diode on the input. This is what I used on my MIDI Footsteps project for the external inputs. http://www.thebox.myzen.co.uk/Hardware/MIDI_Footsteps.html

Zener diodes are fine except they have (need to!) a fantastic capacitance (upto 100pF).

That however will mean little for Arduino applications with laughable 10kHz inputs, but will hinder 10 MHz applications. Above 100MHz even the well meant internal diodes become most critical…

Still, this has to be considered, because you will now need the resistor to limit the Zener current, but 200Ohms/Volt will do for them. 5k *100p will still allow Arduino typical signals.
And you will also find “low capacitance” Zeners in the catalogs…

And consider the much higher current in case of NEGATIVE voltage…