Difference between one-level and two-level E0 encryption
I seem to have found the answers myself:


Two-level E0 uses one instance of the cipher with the master key to generate the internal state for a second instance of the cipher which is then used to encrypt a single frame. I found this out from a slide presentation and a paper describing attacks against two-level E0.
Bluetooth 2.1 does still use two-level E0. HMAC-SHA-256 is only used in combination with P-192 key exchange to derive the master key. Attacks against two-level E0 do apply to 2.1, however the best known attacks require more frames encrypted under a single key than is supported by the protocol. This was made clear in a Security SE answer.