This was something I meant to open a topic for a while myself, but always made my way around that issue by either increasing a delay or waiting for a serial or push button input.
So I'd "highjack" your post - if you don't mind, since it might become handy for you too 
- to ask the pros like @peekay123 or @mdma, if there is a way to know when a OTA download is running (slowish magenta blink, before rapid blink while actually flashing)?
The thing with SEMI_AUTOMATIC is, that user code keeps running during the OTA download phase and hence any WiFi.off() or other command that disconnects the cloud will execute and mess up the OTA flashing attempt.
But if there was a way to know, that a download is going on, user code could take care for that.
I guess there are several threads where users do suffer from this, but might not be aware of it.
e.g. this locked thread, where the OP thinks his code was flashed, but never will be