Hi @ArthurGuy
There is a watch-dog timer that is being used but the core firmware must be deciding to not run your main firmware and run the backup instead. I have certainly seen a panic on top of panic that can cause this in low memory situations.
Obviously the best thing to do is to have as bug-free a program as possible(!), but there can still be things outside our control. Doing a lot of dynamic memory allocation like calling new or malloc or creating String objects and destroying them quickly could all lead to possible problems.
This thread has some info on external watch-dog timers:
Plus there are things like this:
Personally I would use say an NPN transistor to discharge the 220uF cap instead of waiting in software.