I know that nginx is much safer than Apache for hidden services, but is there any additional configuration that needs/should/is recommended to be done to run a hidden service safely?
No, not really. In all cases - regardless of the actual web server - you need to use a FULL ISOLATION based on VM/LXC to run a webserver, so there will be NO technically possible way to determine an external IP address or it's traces. You don't use any NAT/IP-MASQUERADE, just a port-to-port tunneling. I do recommend to use a LXC+static-binaries, it will make a footprint almost-nothing and will minimize an overhead.