Recover from power loss during OTA upgrade

Stash the WORD stored at USER_APP_ADDR in RAM, and only write to FLASH
after verifying the upgrade.

That way if we lose power unexpectedly while upgrading the bootloader
will know that the FLASH is in a bad state and to recover the backup.