Thanks @gr5. I flashed the recovery.img and booted from it. After a while, the dial went green and the LCD said to power down and remove the SD card. After doing that, rebooting normally, and going through the initial setup, the printer was running firmware 18.104.22.16880529. I was then able to upgrade to 22.214.171.12490313, then 126.96.36.19990320. I haven't run a print job yet, but the menus and network connection seem to be working.
I updated my Ultimaker 3 to firmware 188.8.131.5290313, and successfully printed a model. At the end of the print, the screen is stuck at "print removed". When I press the button, it beeps, but remains on that screen. That means I can't access the menus or do anything else with the printer. I tried rebooting, but it returns to the same "print removed" screen. That means my printer is effectively bricked... I can't do anything with it. Is there some way to perform a factory reset without being able to use the menus?