ie carry-on Uber alles

The ragging on the OP strikes me as inappropriate. Yes, they misunderstood the meaning of “IDB”. But they showed up at the airport more than three hours before a domestic flight (I’ve never shown up that early, even for a flight on which I was moving from the US to Australia with a corresponding mess of bags) and AA couldn’t get them on their flight. That’s absurd. At that point, I don’t really care whether it’s AA’s or the TSA’s “fault”. The airline has a heck of a lot more sway with the TSA than any individual traveler, and the airline needs to find a way to make sure that a passenger who shows up at the airport three hours before a flight can get checked in. Passing the buck to the TSA doesn’t cut it; the OP is AA’s customer, not the TSA’s. The airline is effectively the TSA’s customer, and they can deal with the TSA. I don’t care if it’s a trip to Iran and the passenger doesn’t have a visa, let alone a domestic flight.

</rant>

But the reality is that given AA’s screwup, there’s not much I see that the OP could have done differently. I think that as a customer service gesture, the airline owes the OP a pretty large amount of miles, or a refund of a substantial fraction of the airfare. For what it’s worth, a British rail operator gave me a 50% refund, as a matter of policy, for a 32 minute delay on a 2.5 hour trip last week. I was rather (pleasantly) shocked. I don’t expect the same from a US airline for a 30 minute delay, but a day-plus delay because the airline couldn’t get the OP checked in? I think significant cash compensation is due (not legally required, but from a customer service point of view), even though the OP was never involuntarily denied boarding by the letter of the rules.

Where is the cruise departing from? Are there frequent flights, including on other airlines? What does availability look like for alternates? Is it a busy holiday travel weekend? How easy/expensive is it to get to the second or third port of call? Do you have travel insurance to help pay for that?
All that information is key in assessing risk tolerance.
Normally 2 hours would be fine in 99% of cases and 3 hours in 99.9% of cases, but if the cost of being in that 0.1% is so high (eg, see my comments above) then maybe add an hour or two.
On the other hand, at that point you’re more likely susceptible to non-checkin related issues like a maintenance-related cancellation that is completely out of your control, so 3 hrs might be a reasonable limit, past which point you really don’t get any incremental benefit.