OK, I think I figured it out. I tried it on a brand new NA502S that had Image 1 OK and Image 2 Error. I left it connected to the Internet for some time and, contrary to my previous experience, it stayed in a reboot loop. Similar to your experience, OpenWrt would never boot from flash.
Please be careful following the next instructions, you can permanently brick your device if you write to the wrong NAND location.
I compared NAND dumps of different boot configurations. The partition "config" (represented as /dev/mtd1 in OpenWrt) contains the boot flags at offset 0x20000 / 0x20004. It is possible to read/write to the NAND in U-Boot, the following instructions are for the U-Boot command line. Please be aware that the partition /dev/mtd1 is at offset 0x80000, so the location 0x20000 becomes 0xa0000 in U-Boot.
First, examine the current configuration:
sc_nand r 0xa0000
This gives a lot of output, of interest are just the first few bytes:
03 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00
This configuration 0x03 / 0x02 loads kernel 1 on my device. In older dumps, I found the combinations 0x01 / 0x00, 0x01 / 0x02 and 0x05 / 0x06, so I tried them all. The following are my observations:
0x01 0x00 => Kernel 1 (stock configuration before flashing firmware)
0x01 0x01 => Bad Magic Number (reset loop, Linux is not booted)
0x03 0x02 => Kernel 1
0x01 0x02 => Kernel 2
0x05 0x06 => Kernel 2
So on my machine, I issued the following commands to switch to Kernel 2 (OpenWrt):
sc_nand w 0xa0000 0x01
sc_nand w 0xa0004 0x02
Switch back to Kernel 1 (Stock Recovery):
sc_nand w 0xa0000 0x03
sc_nand w 0xa0004 0x02
Obviously, it's not necessary to write to 0xa0004 every time if the value is already 0x02.
It should be possible to set the boot configuration from within OpenWrt as well - I'll figure this out next. I'm quite positive this will also work on the NA502 (i.e. without the "S"), let's see.
EDIT: It might be something like a boot count. I also tried 0x07 / 0x06 and it boots kernel 1. I assume that it just compares the two offsets, if the first one is higher than the second one, Kernel 1 is booted, otherwise Kernel 2. If both are equal, it fails with "Bad Magic Number". 0x00 / 0x01 also loads kernel 2.
EDIT2: Currently, it doesn't work from within OpenWrt as the partition is marked read-only. If I have some free time during the next days, I'll sync my fork with the latest OpenWrt code and remove the flag.