[Exim] Rejecting messages with no Message-Id

Had another good idea for the DATA ACL this morning: reject messages
from !127.0.0.1 with no "Message-Id" header. (Spamware and viruses
generally expect the receiving MTA to supply a message ID. How rude!
That sounds to me like a good reason to reject them.)

But I couldn't get it to work. Here's my ACL condition:

  deny    hosts     = !127.0.0.1
          condition = ${if eq {$h_message-id:}{} {1}}
          message   = no message-id

But in "exim -bh" testing, Exim accepted both of my test messages:
Subject: test
Message-Id: 123

foo
.
and
Subject: test (no message id)

boo
.

The debug output from the last one (ie. the one that should have been
rejected):

>>> using ACL "check_message"
>>> processing "require"
>>> check verify = header_syntax
>>> require: condition test succeeded
>>> processing "deny"
>>> check condition = ${if match {$h_subject:}{\N[\x80-\xFF]{3,}\N} {yes}{no}}
>>>                 = no
>>> deny: condition test failed
>>> processing "deny"
>>> check condition = ${if match {$h_from:}   {\N[\x80-\xFF]{3,}\N} {yes}{no}}
>>>                 = no
>>> deny: condition test failed
>>> processing "deny"
>>> check condition = ${if eq {$h_message-id:}{} {1}}
>>>                 =
>>> deny: condition test failed
>>> processing "accept"
>>> accept: condition test succeeded

Hmmm: either my ACL is coded wrong, or Exim sets $h_message-id: even
when there's no "Message-ID" header. Perhaps Exim sets it to the
Message-ID header that it is going to add (or has already added?).
Any clue?

        Greg