A two-stage load control scheme is presented to address severe under-frequency conditions. The first stage is event-based under-frequency load shedding that guarantees fast response to the detected high-consequence disturbances, for initial system protection. The control signals are obtained by solving mixed-integer programming problems. After the first stage, model predictive control is triggered in the second stage for step-by-step online closed-loop control of interruptible loads, the amount of which is identified via solving linear programming problems. Trajectory sensitivities are used in the optimization problems in both stages to facilitate the analysis. The proposed scheme has been tested on a 9-bus system and on the New England 39-bus system.