Is my XTEA encryption key safe if I publish my firmware both as plain text and encrypted?
What you are describing is called a known plaintext attack. Modern ciphers should be even secure if the adversary chooses the plaintext to encrypt. That would be called a chosen plaintext attack (CPA), and a cipher that protects against is called CPA-secure. Actually, it goes even a bit further than that: IND_CPA means that the ciphertext is indistinguishable from random even if the adversary choses the plaintext.

Basically you can publish any amount of pairs and still be secure. This of course isn't the case anymore if the cipher gets broken. The cipher is completely broken if a key can be retrieved by a CPA attack. Fortunately no such attack is known against XTEA. But note that there are no ciphers that can be proven to be secure.

However, XTEA is a block cipher. A block cipher isn't a generic cipher by itself. It needs a mode of operation to turn into a real cipher. This mode of operation should be initialized using an initialization vector. Without a unique or random initialization vector the ciphertext may leak information about the plaintext. For instance, if you would encrypt two different versions of the same firmware you could see where changes were made.