Some people seem concerned about the priority of arm9loaderhax.bin, and a possible brickage, so here it is.
Here's the code that loads arm9loaderhax.bin payloads in Aurura's A9LH:
Code:
void main(void)
{
if(mountSd())
{
loadPayload(false);
unmountSd();
}
if(mountCtrNand()) loadPayload(true);
//Shutdown
flushEntireDCache();
i2cWriteRegister(I2C_DEV_MCU, 0x20, 1 << 0);
while(true);
}
It always first tries to load the arm9loaderhax.bin from the SD card, and on fail it loads if from the NAND. So, if you need to boot stock luma3ds, you can always put an sd card in with stock luma. You can safetly test this yourself by NOT setting "ignore all key presses on boot" and seeing what comes up when you hold Select with empty SD card, and compare that to an SD card with Luma on it.
In general it should not be possible to brick by placing a payload in CTRNAND, since you can always use an SD card payload, so rest easy.
To answer your question, the last option on the menu is to set up a secret key combo that will open the menu, even if the "ignore all keys" option is set. So if you want a way to unlock without switching SD cards or using a computer, that gives another back door in.