Hm, dumb thought, maybe it's already implemented (I've not looked at the SourceForge U-Boot tree lately, let alone heard much new about the AmigaOne version) ... Maybe there should be a blind flash feature?
Hold down (Ctrl/Alt/Win) - 1, 2, 3, or 4 during boot, and the loader would ignore everything 'risky,' look for a properly-structured ISO9660 image on the IDE device picked (given that we don't really do floppies yet), and provide some feedback (speaker tones, keyboard LED flashes) as to whether it's flashed itself properly or not?
Be a bit troublesome for SCSI, but 1. 90% of everyone's using ATA right now, and 2. if it were worth doing for SCSI, you could, perhaps, have a (Ctrl/Alt/Win)-S to try selecting the first SCSI controller, followed by acknowledging/error response, and the user could then tap the ID of their SCSI optical to attempt the flash.