buttons.c: handle brake sensor failure gracefully

A common failure mode is that the magnet slips and does not provide
the signal, so it appears as if constantly braking. Avoid this situation
by allowing continuous braking of at most 16 seconds. After that, report
brake off, and wait for the real "brake off" signall from the Hall sensor.