Thanks for linking that post, makes perfect sense! Also seems to explain why the problem was intermittent at first, and why the firmware screen shows 4 but the self test shows 8.
I'm thinking if it's stuck like this now, maybe I can just remap the buttons with the correct functions/circuits...