I don’t think you have much option other than reorganising the bridge/VLAN setup. You could just convert from master-port to bridge and leave the VLAN interfaces attached to other bridges setup, except there are many pitfalls see https://wiki.mikrotik.com/wiki/Manual:Layer2_misconfiguration especially points 6 to 8. Many of these exist even with the master-port setup, they were just not well documented.
Back when converting configurations with master-port setups I created a new bridge, moved the main interface plus attached references (VLANs, IP addresses, DHCP clients/servers, firewall interface names, etc.) before the upgrade to reduce who much the inbuilt conversion process had to do.
I always use safe mode when running sets of commands to adjust the remote configs which could result in things going badly wrong. As you don’t have that option for firmware upgrades bench testing on backup hardware can uncover unexpected behaviour, and for really critical devices it may be better to configure an identical device and just swap them during a scheduled site visit.
Hopefully this device has not had its web UI or Winbox exposed to the general internet (i.e. remote admin access restricted by address lists or by using VPNs), otherwise it will almost certainly have been compromised and need a complete wipe with netinstall to remove all traces.
Assuming you don’t require full wirespeed switching between the two LAN ports and trunk port (ether3/4/5) the simplest solution would be to have a single VLAN-aware bridge - this disables the hardware switching between ports, but other than the path mentioned all traffic has to be processed by the CPU in any case.
I’ve not used metarouter much, or for ages, mostly as it isn’t supported on many of the newer Mikrotik architectures (ARM, MMIPS, TILE). There is this http://forum.mikrotik.com/t/metarouter-move-to-another-host/69823/1 in the forums, there may be other posts if you search the forum.