Connect serial,
press 4 to acces uboot console, change flag_try_sys2_failed to 1 by
setenv flag_try_sys2_failed 1
check wheter it is modified with
printenv
if its good then commit this
saveenv
if it was successfully saved then pull out the power and replug. If you stay inside serial console then you will see that it will try to boot both rootfs without succes so it will bootup kernel0 with usb recovery then insert usb with miwifi.bin then press eset until led is changed to orange.
I've did exactly same thing yesterday... A friend of mine flashed a mir3g fw to his r3. -.-
Wait kernel0??? you flashed kernel1.bin to kernel0 partition? that was a big mistake... if you do you have to find a working kernel0 then flash it via tftp in uboot.