Is there a function we can implement that gets called before new firmware gets flashed onto a device?
Not yet, no.
We plan to implement “polite upgrades”, which would allow you to be notified that an upgrade was about to be applied. You’d also have the option of temporarily rejecting it (in case, say, your imp-powered UAV was in the process of landing…). It’s on the roadmap for this year, but we have no firm dates, yet.