I found that device has a “rescue” mode. To enable it you need to power off device completely, press “Eject” button, plug power cord to socket and wait. It will start USB update procedure. I think it was done to rescue devices if update fail for some reason. This mode using kernel and file-system from different partitions, so it works without primary kernel. Using this mode it flashed mtd5 partition with custom kernel. I just added some debugging support to the i2c driver. Unfortunately kernel was not able to load for unknown reasons. Good news is that i was able to debrick device using rescue mode (i did backup of the original kernel).
So probably i will stop my kernel hacking efforts until getting serial connection. May be i will also try to recompile kernel w/o any modifications to check if it works.
Update: i was able go load self-compiled kernel. but it does not work as expected now