Without a set of mathematical model to compare with the Simulink model, it is rather difficult to identify the real cause. However, there are a few things you can check.
Update: The circle parts in Fig. 1 are the signals that cause the termination in simulation at the Integrator block. Whether traced further in Fig. 2, it seems that the filtered derivative blocks in the Model of Canals caused the signals to blow up.
Comment: Once the root cause is identified, you need to fix them mathematically. I'm unfamiliar with the Graviceptor system. If you can find out which signal can be manipulated and the location to inject such stabilizing signal, then it is possible to stabilize the system using math wonders (concept of dynamic inversion).
Fig. 1
Fig. 2
