Unfortunately the way it works, is once you ever run any non-nokia-signed kernel, even just boot it and then immediately reboot with signed kernel, the device goes to open mode and it cannot be put back to normal mode except by flashing it.

I guess this is Nokia's way of ensuring device security/protection, you cannot go to open mode to make some tweak and then return to normal mode

There's just one thing that is available in normal mode and not in open mode, and that's device locking. Everything else works OK, so I always run my devices in open mode.
If you absolutely need device lock, then I'm afraid custom kernels and other advanced tweaks are not possible for you, but I assure you everything else works in open mode correctly.