[Galaxy Tab S Original Android Development] :
You can take chainfires SuperSU from the list - I'm using it, and it does not overwrite cm's busybox. I'm afraid it's exposed itself, but don't know. And I'm afraid there are other zip's and apps, too.

BTW: for those who are interested: I digged a lot through UKM (Universal Kernel Manager) lately. And they do it in a very clean way to bring their own busybox. They install it in a seperate directory, that is not contained in any known system PATH enbironment and set the variable BB to their own busybox. Then they use in their scripts somthing like

$BB mount bla fasel

I like that!!!

As for your backup: most likely the permissions doesn't persists. I send you a listing:

/ #ls -laRn /storage/sdcard1/TWRP/
/storage/sdcard1/TWRP/:
drwxrwx--- 1 0 1028 131072 Oct 6 22:03 .
drwxrwx--x 1 0 1028 131072 Jan 1 1970 ..
drwxrwx--- 1 0 1028 131072 Oct 6 22:03 BACKUPS

/storage/sdcard1/TWRP/BACKUPS:
drwxrwx--- 1 0 1028 131072 Oct 6 22:03 .
drwxrwx--- 1 0 1028 131072 Oct 6 22:03 ..
drwxrwx--- 1 0 1028 131072 Nov 19 19:46 3204db1846e27169

/storage/sdcard1/TWRP/BACKUPS/3204db1846e27169:
drwxrwx--- 1 0 1028 131072 Nov 19 19:46 .
drwxrwx--- 1 0 1028 131072 Oct 6 22:03 ..
drwxrwx--- 1 0 1028 131072 Oct 24 09:13 2014-10-24--10-05-00 KOT49H.T800XXU1ANH1
drwxrwx--- 1 0 1028 131072 Nov 19 19:51 2014-11-19--20-46-38 cm_chagallwifi-userdebug 4.4.4 KTU84Q 9b5ec

/storage/sdcard1/TWRP/BACKUPS/3204db1846e27169/2014-10-24--10-05-00 KOT49H.T800XXU1ANH1:
drwxrwx--- 1 0 1028 131072 Oct 24 09:13 .
drwxrwx--- 1 0 1028 131072 Nov 19 19:46 ..
-rwxrwx--- 1 0 1028 8388608 Oct 24 09:05 boot.emmc.win
-rwxrwx--- 1 0 1028 48 Oct 24 09:05 boot.emmc.win.md5
-rwxrwx--- 1 0 1028 61440 Oct 24 09:05 cache.ext4.win
-rwxrwx--- 1 0 1028 49 Oct 24 09:05 cache.ext4.win.md5
-rwxrwx--- 1 0 1028 57 Oct 24 09:05 cache.info
-rwxrwx--- 1 0 1028 1537706496 Oct 24 09:11 data.ext4.win
-rwxrwx--- 1 0 1028 48 Oct 24 09:13 data.ext4.win.md5
-rwxrwx--- 1 0 1028 65 Oct 24 09:11 data.info
-rwxrwx--- 1 0 1028 20971520 Oct 24 09:05 efs.emmc.win
-rwxrwx--- 1 0 1028 47 Oct 24 09:05 efs.emmc.win.md5
-rwxrwx--- 1 0 1028 3707641 Oct 24 09:13 recovery.log
-rwxrwx--- 1 0 1028 1469361664 Oct 24 09:08 system.ext4.win
-rwxrwx--- 1 0 1028 50 Oct 24 09:08 system.ext4.win.md5
-rwxrwx--- 1 0 1028 65 Oct 24 09:08 system.info

/storage/sdcard1/TWRP/BACKUPS/3204db1846e27169/2014-11-19--20-46-38 cm_chagallwifi-userdebug 4.4.4 KTU84Q 9b5ec:
drwxrwx--- 1 0 1028 131072 Nov 19 19:51 .
drwxrwx--- 1 0 1028 131072 Nov 19 19:46 ..
-rwxrwx--- 1 0 1028 8388608 Nov 19 19:46 boot.emmc.win
-rwxrwx--- 1 0 1028 48 Nov 19 19:46 boot.emmc.win.md5
-rwxrwx--- 1 0 1028 1546056704 Nov 19 19:50 data.ext4.win
-rwxrwx--- 1 0 1028 48 Nov 19 19:51 data.ext4.win.md5
-rwxrwx--- 1 0 1028 65 Nov 19 19:50 data.info
-rwxrwx--- 1 0 1028 20971520 Nov 19 19:46 efs.emmc.win
-rwxrwx--- 1 0 1028 47 Nov 19 19:46 efs.emmc.win.md5
-rwxrwx--- 1 0 1028 1520071 Nov 19 19:51 recovery.log
-rwxrwx--- 1 0 1028 415589888 Nov 19 19:47 system.ext4.win
-rwxrwx--- 1 0 1028 50 Nov 19 19:47 system.ext4.win.md5
-rwxrwx--- 1 0 1028 64 Nov 19 19:47 system.info

User and group are numerical values, string of group is always tuncated and therfore misleading. As root:

chown -R 0:1028 /storage/sdcard1/TWRP

chmod -R 0770 /storage/sdcard1/TWRP

should fix it. Perhaps you have to adjust paths.

For MENU: I expected that. Would have been to easy... Thanx for your help.