Robust closed-loop control of systemic oxygenation in acute lung injury