I don't get it where $root_dev in the script is and which (hardcoded?) rootfs it used for the dynamic menu. Isn't it chicken and egg problem? People can have random rootfs in internal flash (Poky, Android, Mamona, whatever) so there is no 'standard' place to install such menu in rootfs. Also with reflashing rootfs in internal flash you'd loose such menu even if the rest of the systems on mmc is fine.

As for /linuxrc in rootfs, is this really used instead of /sbin/init in some systems? Maybe the code should fallback to run /sbin/init if /linuxrc is not found instead of plain reboot?

Having some workaround for the funky stuff you mention done by nokia /linuxrc in initfs should be useful though. But still, I'd like the bootmenu code to fallback to nokia /linuxrc in intfs so the system is properly initialized (see the boot() function in linuxrc, loading wi-fi module and telling dsme that the rootfs is mounted can prevent some surprises even in your random rootfs)