this fixes two issues found by night-ghost. The first occurs if a 16
bit flash write is not atomic and only the first byte is written. Then
we could end up declaring the data invalid on reboot and erasing.
The second is a race in switching sectors. If power off occurs at the
wrong time we would trigger en erase on reboot.