My method is to jump directly into the IAP code at f803. I restore all registers before doing this. For the "AT" vertion I must do this before running any user code except checking if my own eeprom flag to jump to IAP is set. It may still be possible to do it anytime, but I don't have the time to look to what other SFRs are changed that I am missing.

With my method, user code can still execute on the next power up, providing the user either doesn't run FLIP, or runs it correctyly.