I see, is this crypto map solution already implemented? I cannot determine which network design would be the best for you, since I am not familiar with all your internal policies and requirements, but I can suggest.
Usually, I encourage people to use VTI or DMVPN since they are more scalable and easier to maintain than LAN-to-LAN tunnels with huge ACLs.
My idea is this:
Tunnel1 Tunnel1
|-------------| |-----------|
Hub | Internet | Spoke
|-------------| |-----------|
Tunnel2 Tunnel2
An IGP running across the tunnel interfaces (VTI) will make the routing decision for you, according to how you tune it up.
For instance:
You could use EIGRP to load-balance (equal cost at this point since you only have two links) the traffic:
EIGRP load-balancing
So the Router will keep both IPsec tunnels up and traffic will flow across the Tunnel interfaces following the EIGRP routing conditions.
*******************
On the other hand, if you want to go with the crypto map condition, I would still suggest GRE/IPsec and do the same thing, but lets say that GRE will not be used.
Without any kind of Routing protocol, load-balancing will not be achieved at all, you can still have two routes pointing to two next-hops to reach the same destination network, but this is not recommended and may not behave as expected.
*****************
Summary:
In order to load balance traffic across two tunnels, I suggest:
1- DMVPN
2- VTI
3- GRE/IPsec
In conjuction with an IGP.
