You need a mechanical physical switch with a switch guard.
No, you DON'T!
If you had such a switch, pushing it would have to be part of the test. Otherwise you've created a single point of failure that causes the live function to fail even though the test psses - and you don't find out until the missiles are inbound.
Yes, they should have done things like word and position the menu items differently, so hitting the wrong one by accident was less likely, and have glaringly different text and graphics (by selection, with the function still identical) for the confirm popups. But the further the test and live functions diverge, the more opportunity you have to build a system that passes the tests but doesn't work when you need it.
Conelrad (cold-war predecessor to the Emergency Broadcast System) had a similar failure: The test and inbound-nukes kickoff keys were paper tapes on adjacent pegs, and one day the low-ranking communications guy put the wrong one in the teletype tape reader on weekly test day, telling the whole country to duck and cover. Nothing new here.
(The teletypes had a bell and the newswires had a number-of-bings code for how urgent a message would be. I think major stories rated about a three. Max was ten, which was reserved for nuclear war warning activations. I recall one time in '65 or '66 when the AP wire tape got stuck on the bell code and that thing rang something over 30 times before they got it unstuck... Fun times.)