The code is difficult to follow not knowing it. The balance bot falls going backwards:
When going forward the pitch ATT.Pitch is slightly negative, but when going backwards it turns slightly positive and, without the protection, it goes to 90º (falls).
Here are the RCIN.C2 messages: at first 1956 µs (forward) and later 1115 µs (note it is a 3-channels car radio):
(MP shows RCIN.C2 graph strangely).
Here is the log. I can do a video if necessary; it is easy to reproduce, and the protection is quite notorious going forward, and also the lack of it going backwards.