If the pfSense team is in on this one , you could make a "recovery-xonfig.xml" in the script ,
and on boot check if it exists. If it exists : use that one (and delete it after boot) , else use normal config.xml.
And then just a :
reload in xx minutes entry in the menu - making the revovery-config.xml , and the at now+xx (reboot)
And
a reload cancel , that deletes the revovery-config.xml , and kills the at job
I don't know the "inners" of pfsense , and don't know if it goes "crazy" if the config.xml gets replaced , but i'm sure the team could make this in a short time.
/Bingo