microcontroller with buttons/LEDs -- fallback when Hi-Z
simulate this circuit &ndash; Schematic created using CircuitLab

Figure 1. An alternative.

This might be a little simpler - if I've covered all requirements.


  If the top end switch is touched, then positively, definitely do not go further up.


Satisfied. Opening UP_LS will turn off the opto-LED.


  The MCU needs to know if the end switch is touched, not only for the sake of stopping.


Satisfied. The limit switch monitor [C] will pull high when the switch opens.


  The push button is multi-purpose, including the menu navigation and alike.


Satisfied - maybe. The button monitor [A] will report the state of the switch. During automatic opreation [B] will pull high and VA will be equal to the VF of D1. If this is a problem another diode in series with R1 and a pull-down on [A] should fix that.


  However, if the MCU is down (a firmware update went wrong etc.), the push button starts the motor.


If the microcontroller is running then [B] should be low which will short out D1. If the micro fails (and the output tri-states) then the UP button will illuminate D1.


  As long as the MCU is running ... the push button is solely for the MCU and should not start the motor.


Satisfied. When [B] is low the LED is short-circuited.

I have deliberately omitted your indication LED for simplicity. Adding it back in affects the VF considerations above so the additional diode and pull-down would be required to prevent false button reads on [A].