Debrick my Xiaomi Mi Router 3G

Hi, all.
I played with Lede on the router in subject.
During the experiment, I, apparently, messed something I should not.
Now I am in a difficult situation:

  1. The router only lights the orange LED and that's it.
  2. Connecting serial console works and spits this:
[22:49:22:232] ␍U-Boot 1.1.3 (Apr 15 2016 - 17:46:32)␊
[22:49:22:232] ␍␊
[22:49:22:232] ␍Board: Ralink APSoC DRAM: 128 MB␊
[22:49:22:232] ␍Power on memory test. Memory size= 128 MB...OK!␊
[22:49:22:236] ␍relocate_code Pointer at: 87fb8000␊
[22:49:22:240] ␍enable ephy clock...done. rf reg 29 = 5␊
[22:49:22:250] ␍SSC disabled.␊
[22:49:22:250] ␍!!! nand page size = 2048, addr len=4␊
[22:49:22:250] ␍..============================================ ␊
[22:49:22:292] ␍Ralink UBoot Version: 4.2.S.1␊
[22:49:22:292] ␍-------------------------------------------- ␊
[22:49:22:292] ␍ASIC 7620_MP (Port5<->None)␊
[22:49:22:292] ␍DRAM_CONF_FROM: Auto-detection ␊
[22:49:22:292] ␍DRAM_TYPE: DDR2 ␊
[22:49:22:292] ␍DRAM component: 1024 Mbits␊
[22:49:22:292] ␍DRAM bus: 16 bit␊
[22:49:22:292] ␍Total memory: 128 MBytes␊
[22:49:22:314] ␍Flash component: NAND Flash␊
[22:49:22:314] ␍Date:Apr 15 2016 Time:17:46:32␊
[22:49:22:314] ␍============================================ ␊
[22:49:22:314] ␍icache: sets:512, ways:4, linesz:32 ,total:65536␊
[22:49:22:314] ␍dcache: sets:256, ways:4, linesz:32 ,total:32768 ␊
[22:49:22:314] ␍␊
[22:49:22:314] ␍ ##### The CPU freq = 580 MHZ #### ␊
[22:49:22:328] ␍ estimate memory size =128 Mbytes␊
[22:49:22:328] ␍␊
[22:49:22:341] ␍Please choose the operation: ␊
[22:49:22:341] ␍ 1: Load system code to SDRAM via TFTP. ␊
[22:49:22:341] ␍ 2: Load system code then write to Flash via TFTP. ␊
[22:49:22:341] ␍ 3: Boot system code via Flash (default).␊
[22:49:22:341] ␍ 4: Entr boot command line interface.␊
[22:49:22:341] ␍ 9: Load Boot Loader code then write to Flash via TFTP. ␊
[22:49:22:348] ␍␊
[22:49:22:348] ␍ ␊
[22:49:22:348] ␍3: System Boot system code via Flash.␊
[22:49:22:348] ␍Booting System 2␊
[22:49:22:352] ␍..ranand_erase_write: offs:40000, count:20000␊
[22:49:22:567] ␍.Done!␊
[22:49:22:870] ␍done␊
[22:49:22:870] ␍## Booting image at bc600000 ...␊
[22:49:22:870] ␍ Image Name: MIPS LEDE Linux-4.9.47␊
[22:49:22:889] ␍ Image Type: MIPS Linux Kernel Image (lzma compressed)␊
[22:49:22:889] ␍ Data Size: 1694349 Bytes = 1.6 MB␊
[22:49:22:889] ␍ Load Address: 80001000␊
[22:49:22:889] ␍ Entry Point: 80001000␊
[22:49:22:889] ␍.......................... Verifying Checksum ... OK␊
[22:49:25:671] ␍ Uncompressing Kernel Image ... OK␊
[22:49:28:238] ␍commandline uart_en=0 factory_mode=0 mem=128m␊
[22:49:28:238] ␍No initrd␊
[22:49:28:238] ␍## Transferring control to Linux (at address 80001000) ...␊
[22:49:28:238] ␍## Giving linux memsize in MB, 128␊
[22:49:28:238] ␍␊
[22:49:28:238] ␍Starting kernel ...␊
[22:49:28:238] ␍␊
[22:49:28:238] ␍

And that's it.
It does not go up at all, the kernel log does not show in console (might be due to the parameter uart_en=0).
The problem is - the start menu is ignoring all the inputs - it just straight goes for option #3 no matter what I try to submit.
Any ideas how to somehow flash some working firmware into this box?