MACH:
IF (big IF), in fact, the FD 'bit' him at any point, I 'spect it's the return at 2:10:47 when the CAS is 216k and aircraft vertical speed is +1500 FPM which is what the FD vertical command would have defaulted to because the FD buttons were still engaged. With the nose already having come down from 10-12 degrees to 5.6 degrees (1500 FPM) this would be a 'relatively' subtle nose up command initially that, if flown, could rapidly go full scale taking him back to the documented 13 degrees after 2:10:51 as airspeed continues to decay.
V/S 1500 would also have been annunciated on the FMA at this time.
The FD would indeed only default to ALT CRZ* if within FMGEC CRZ ALT altitude capture parameters (i.e. 34,976), and the FD would, at the earlier time of 2:10:17, have been in the process of providing a vertical command consistent with leveling off at FMGEC/FCU CRZ ALT. It was only available in this mode for 4 seconds before it dropped out again. By 2:10:47 they were well above FL 350 (default mode is V/S).