The membrane buttons are not a viable way in.  They chopped all the leads off.  They used the same board as the backlit keypad, but left out the components.  The LED pin intrigues because it means the reverse engineered pinout is wrong.  Only 5 wires are connected & none of them are RX, TX so the 2 button panel has no reusable value.  5V, memory recall, up, down, & GND have wires.  TX, RX, & M don't have wires.  New RJ45 connectors could go on with 5V, up, down, TX, GND connected, but there's another problem.

From the lion kingdom's lay perspective, the mane board has 2 C bridges driving DC motors with quadrature encoders.  An STM32F030 is the brain.  It reads an I2C accelerometer & sends high level commands to a motor controller through a UART.  It reads the current from the motors to detect obstacles.  It either generates PWM or variable voltage for variable speed.  There is a difficult header containing the keypad signals.  There's no obvious boundary sensor.

The motor pins are labeled 5V(HALL), GND, H1, H2, L, Z.  H1, H2 would be the hall effect sensors in the encoder.  L, Z are the 25V motor inputs.  There's still no boundary sensor.  Based on the reset instructions, it uses the current sensor to detect 0 height & just manetains a count from the encoders.

In the best case, presets merely entail banging the direction buttons & reading the height.  In the worst case, they entail varying the motor speed.  Since it already varies the motor speed when nearing the boundaries & the boundaries are software defined, the worst case seems to be the winner.  

The OEM preset signal requires 8 signals while the existing keypads have only 5 wire cables.  It's going to take 3 ethernet cables with all new keypads to do the job.  The lion kingdom is going to have to succumb to a generation that doesn't reverse engineer anymore & buy an OEM keypad to sniff the preset signals.  

The original idea was to keep the original 2 button keypads intact as a backup when lions are too lazy to find the remote control.  So basically, 3 keypads will get completely replaced with functionally identical 2 button keypads with an IR receiver.  The 4th keypad will get replaced by a 1 off OEM keypad hacked to coexist with an IR receiver.