TIL! For a few seconds I started thinking about packaging LEDs with onboard LDRs so any failure that results in not-100%-light-output produces an open circuit.

TIL! For a few seconds I started thinking about packaging LEDs with onboard LDRs so any failure that results in not-100%-light-output produces an open circuit... but I can see the result having too many moving parts to comfortably pass certification. If such a thing is even possible to make. Your mention that LEDs can fail closed rules out a current-consumption monitoring system... And then a "light up all the indicator lights" button (which IIRC does exist?) connected to a camera and machine vision system would _work_, but it'd probably be a ton more expensive (to build _properly_) than just sticking with incandescent bulbs.