Suppose an attacker makes a double-spend and controls the mining pool that happens to find the good which confirms the transactions. What happens? I suppose the network hopes that a vigilante sees the double spend on the block chain and notifies everyone. Then what happens? Do the mining pools coordinate and remine the block? Seems like a big disruption. Is there a more elegant solution?
Every single Bitcoin node in the network will reject and ignore the block as invalid if there is a double spend in it. The block won't even spread very far, because the peers that first receive it will ban the miner who sent it and not forward on the block to any other nodes.
It is not a big disruption as the check for this is fast. Other mining pools don't need to "remine" it , they'll just recognize the submitted block as invalid, and keep working on their own block.