Geofencing should be completely outside transmitter_control_selected_controller(). This makes it a difficult fit with the current code since the controller is being chosen by the transmitter (or lack thereof). Geofence is an additional failsafe mode: where our prior one triggers on RF this new one triggers on geolocation.

Maybe what we need is a more flexible idea of failsafes. I introduced this somewhat with nice_crash and nasty_crash (I was tempted to call it naughty_crash), but they don't really go far enough.