I think is a silicon problem.
My application runs through the whole MCG state machine continuously. I have found the only way to prevent a lock is no to change C1[IREFS] and C1[CLKS] at the same time !
When the MCU just started you can change the whole 3 bits in one command, but after it passed through a few states the MCG locks.
Safest way I could find was to ignore FEI-FBE, FEE-FBI, FBE-FEI, FBI-FEE, FBI-FBE, FBE-FBI changes, so the MCG will never go through those states.
The above sample code is not much help, as it assumes some premises which I do not have. It is also poorly documented, with fixed valued instead of bitmasks, making it very hard to read and understand.