modify initramfs.c to check the reboot reason. if recovery then only internal ramdisk is
loaded, otherwise the external ramdisk is used.

switch default bootmode on power up to be recovery. this will make a good failsafe as long
as the kernel contains a valid recovery ramdisk