Pattern matching is the answer. Instead of:

if user && user.address && user.address.city do
  ...
else
  ...
end

do:

case user do
  %{address: %{city: city}} when is_binary(city) -> ...
  _ -> ...
end

One year later but the answer to your question is get_in+Access.key.

def, defmacro, and defmodule are already plain macros.

Most people working on the compiler would love to get rid of this too, but it’s a backwards-incompatible change. So we have to live with it until 2.0.
You can easily introduce a new lexical scope by wrapping in try do <code> end.

Furthermore, Elixir has hygienic macros, so it won’t leak between contexts. You’re building the variable AST by hand working really hard to work around the regular (hygienic) macro mechanisms and then complaining it’s not hygienic
What’s more, you can rebind variables, so it’s perfectly fine to have something like this in reduce:

case unquote(maybe_map) do
  nil -> nil
  map -> Map.get(map, unquote(k), nil)
end

This leads us to yet another realisation that we never bind any variable using = so nothing will ever leak, even with current implementation:

iex(1)> case %{} do
...(1)>   map -> map
...(1)> end
%{}
iex(2)> map
** (CompileError) iex:2: undefined function map/0

This means the whole thing can be simplified to:

defmodule SafeNilGet do
  defmacro sng({var, _meta, ctx} = ast) when is_atom(var) and is_atom(ctx) do
    ast
  end
  defmacro sng({{:., _, [v, k]}, _, []}) when is_atom(k) do
    quote do
      case sng(unquote(v)) do
        nil -> nil
        map -> Map.get(map, unquote(k), nil)
      end
    end
  end
end

iex> import SafeNilGet
SafeNilGet
iex> map = %{blah: %{blorp: %{bleep: 42}}}
%{blah: %{blorp: %{bleep: 42}}}
iex> sng map.blah.blorp.bleep
42
iex> sng map.blah.wrong.bleep
nil
iex> binding()
[map: %{blah: %{blorp: %{bleep: 42}}}]