Just re-iterating my hope that you make the firmware split (fixed bootloader and reflashable main part), that way, when the payment protocol work is progressing it will be a smooth upgrade to have Trezors show names instead of addresses.
After long discussions with Stick, we decided that we'll offer also unlocked devices (bootloader + refreshable memory), so people will be able to update firmware. I think this is important especially in the beginning, when some bugfixes and new features may happen. Reflashing will be protected by pressing both buttons during power on. Then the Trezor will appear as USB mass storage device and user will be able to upload its own firwmare to the device.
All memory will be erased on firmware update, including seed (remember, user has his seed written on paper on safe location). So user will be able to detect if firmware has been changed by someone (device will be unitialized or will have another seed) and attacker won't have a chance to read seed from the device.
I welcome this. Maybe it'd be a good idea to have the casings of the flashable trezors a certain color and the non-flashable another one?