I don't think you can make a 'hardware' force-function as to which flash-half to boot from based on the 'reset reason'. Once you have validated a flash-half-burn and set the 'next boot' to that image, that is what you will run. You should be able to make a decision 'early on' in both images as to the cause and make a decision whether to 'stay' or 'revert'.
Personally, I abandoned the 'swap' mechanism when Freescale made it so specific in its operational modes -- we had more control over the first form. As a result, we now put a cheap 75-cent SPI EEPROM (1MB) in our systems, and dedicate the first 16K of Flash to a bootloader function. The bootloader CRCs itself, and the application image, and also looks into the EEPROM for a 'code update' image. If it finds one, it burns said image before jumping to the application. We can use the full 'Ethernet' connectivity of the application, for instance, to load the EEPROM with the 'next version' code. Within the application image operations is a process to 'validate' the general operation, and if it finds itself capable of all proper operations, it 'validates' the code image stored in the EEPROM. If a reset comes about before such validation, then the bootloader will 'scratch' that image, and re-burn the next-older image in the EEPROM to revert to something that worked. The bootloader can also overwrite itself from one of these images, but of course without that original 'I was in control' swap mechanism, I can no longer make that 'bulletproof', so there is a weakness there if something happens during bootloader self-update (so don't do it very often!). So with all this we get some complete control over what gets programmed, AND we get to use nearly ALL the flash within the Kinetis part for functional code.