After reverse engineering the UBOOT firmware at APPSBL, it seems that we can't totally disable the auto recovery function. However, the firmware will check the boot_count against the boot_ready_count,
so we can set the environment variable boot_ready_count to a very large number (e.g. 1000), and then the recovery functionality will be "disabled"
setenv boot_part_ready 1000
save
After that, you can see that the maxpartboots variable will be 1000 in the log, and you can see that even the boot count is 5, the device is not erasing its firmware.