I think the best solution would be your first one, but have the second part be stored on removable media, like an SD card. Make it physically impossible to write changes to anything but the SD card (e.g. use actual ROMs for the first part, and use volatile RAM for temporary storage of the code loaded from the SD card).

Then, if you want to be sure that the firmware isn't hacked, simply remove the SD card, put it in a computer, and verify the contents. If paranoid, overwrite the SD card with the official firmware. If extremely paranoid, throw away the SD card, buy a new one, and write the official firmware to it.