Yes, when you boot the device after using rescue kernel, you need to remove the USB cable first.

Which warning is it, is it the MALF warning or the Openmode warning?

If the device shows the MALF warning you need to check for the file "/var/malf" from the root partition (/dev/sdb2). If that is present it means that in boot phase the device has detected that a file has been modified.

The way it is done, is that most of the important binaries and configuration files are hashed and the hash is stored to a refhash list file. (that's /var/lib/aegis/refhashlist)
When the device boots, it will check the hashes of that list against the files, and if there is a difference it will show the MALF warning and refuse tpo boot.
Even if you change back the file you modified, the "/var/malf" may not be removed and the device will again show the warning on the second boot... that's why you need to rehash the modified files and remove the /var/malf file to get the device to boot.

Using open mode is so much simpler, there is no need to worry about MALFfing the device while tuning something.