Can you still get to systemctl from android? Might be an idea to write a unit file for surfaceflinger, and get systemd to start lipstick when it exits.

Using a 'Conflicts' directive you can stop lipstick when the surfaceflinger.service starts, and with a 'OnFailure' directive you can start lipstick again when you kill surfaceflinger from inside.

This also looks like a way to get the buffer output of Surfaceflinger and could be useful for integration work later.