Copter: force the exit from any failsafe with "double flight mode switch"

A friend has destroyed his quad because unfortunately switched a flight mode half a second after the battery failsafe is activated, continued to fly not realizing that the battery was too low.
The "RTL" in the image are related to "battery failsafe", although for reasons that we are investigating is not properly displayed as "failsafe event".
To avoid this event, which can happen if you're very unlucky (like my friend), i therefore propose to include in the code an option that allows to force the exit from any failsafe only by double flight mode change (not just one as it's now), who still I think it is even more logical, in this way to force the failsafe exit execute a double switch in the back way where I was flying (es. i'm in Stabilize, to force the exit i switch to Loiter and back to Stabilize).
Another friend mistakenly switched to another flight mode while its S900 was performing an RTL from "battery failsafe" and had the throttle to zero, switching to Stabilize destroyed the drone.


No source file, test, or entry point is named. Start by locating ArduCopter's battery-failsafe handling and flight-mode switching logic, then trace how a mode change currently exits a failsafe; done means the proposed double-switch behavior is implemented as an option and verified for the described RTL and Stabilize scenarios.

Written by the indexing model from the issue text.