I think the only way to "brick" the device is to overwrite the config partition (mtd1). The IMEI and WLAN MAC are stored there and probably cryptographically signed.

If the 'u' key does not work, I think there is one more way to recover the device - cold flash. You have to start flasher with the cold flash option, then remove battery from n900, connect it to the usb port and insert the battery. The OMAP processor contains the built-in ROM which is able to download code via USB. You cannot download any code, it has to be signed. I have not tried to cold flash yet, however I have been able to download the original bootloader using my own USB loader, so I think that cold flashing via USB should work, and some people here have reported a success.