You cannot do it. Plain and simple - think about it for a second. If any upgrade will work what would prevent you from rooting your device? Theoretically Sony could produce a working upgrade like you want - we however cannot (do not have Sony's private key). On non-jailbreaked device with the hole plugged you are not capable of running any upgrades we produced, period. In addition Sony never supported firmware downgrades - there is an extensive check for versions. The only way to really downgrade your firmware is to have a COMPLETE backup of flash (produced using my backup/restore method), but since your device is closed and ignores my code - you do not have this option.
Forgot to mention: if you are handy with soldering iron and know electronics - you could open your device, connect something like bus pirate
or modified card reader directly to flash chip removing SMT resistors from the device main board (Sony is using the same SanDisk 2Gb SDIN5D1 chip for both T1 and T2) and jailbreak your device "directly" by overwriting either partition 1 or partition 2. Effectively this will unplug the hole in firmware. It is entirely doable and it was done before. Good luck and do not forget to post the pictures of your progress here