The flash procedure seems to be "do it via the the web interface, if the IMM won't load, boot the backup IMM and do it via the web interface".
As far as I could see in the manual, if the backup IMM won't load either, replace the motherboard. Surely must be a header somewhere I could flash from, though?
Struggling to find any cheap replacement boxes on eBay, thankfully it's just a Plex and file storage server of little consequence to anything mission critical - glad I'm not trying to explain to the bean counters why the beans are no longer being counted.