Even better: include a custom known-to-work busybox with backupmenu. External dependencies are OK as long as the interfaces don't change. A package dependening on some particular funcionality provided by "/bin/sh" is asking for trouble.

The world is bad enough seeing how many shell scripts rely on bash being /bin/sh, so if you (e.g. backupmenu) have a explicit dependency then it has to be clear. In the case of busybox it's not enough to add a dependency because of the number of busybox'es available, so the only solution is to embed it in backupmenu (doesn't it include gnu-tar anyway?).