"- replacing that feels like a really bad idea, but if you do the other stuff then as long as they don't flatten the battery and hold the button while applying power, they will never see it."
Yeh that's still the use-case I'm worried about... Simply because it takes 'more' than a quick click of the button to turn the Bangle on (I typically have to hold for about 1 second to boot)... so if the user's first attempt to turn it on is too short they might overcompensate with a long press (holding for about 2.5 seconds typically starts the bootloader from off).
I could make a little print off to give to the user before testing with them, detailing what to do if they accidentally trigger the boot loader (they will be with the device for a few weeks unsupervised... and with my app they can expect to need to charge it regularly otherwise the battery will run flat)...
Unless there's some simple modification I can make to the firmware... I'll probably just go with that.
Btw is this expected behaviour for the firmware without the recovery menu?: https://www.youtube.com/watch?v=sDSFhLWgZKo
I notice if I allow the ===> to progress all the way to the end and I KEEP holding the button down , it goes to the Expruino splash screen... (where as if I let it go straight away after ===> fills up it initialises my app) .... but it stays at the Espruino splash screen until I go back to the boot loader. It would be handy if the user accidentally gets to that splash screen it would just know to initialise the app (and maybe that's actually the expected behaviour?).