I stumbled upon this post, while I was researching a similar topic.
I know I'm a bit late here. Regardless, I thought I would leave a reply, for future reference.
If you want to move the "icmp" Rule, directly above the "udp" rule, you have multiple options.
[admin@MikroTik] > ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; udp
chain=forward protocol=udp action=jump jump-target=udp
1 ;;; icmp
chain=forward protocol=icmp action=jump jump-target=icmp
I tend to refrain from using "Item Numbers" at all times, since they are NOT static.
Not to mention that there is a Warning, on the "Console" Page, of the MikroTik Manual, stating NOT to use "Item Numbers" in Scripts (https://wiki.mikrotik.com/wiki/Manual:C ... em_Numbers
As a result, I've began working w/ Internal IDs, exclusively.
Firstly, you can use the "find" command twice, within a "move" command, as follows.
/ip firewall filter move [find comment="icmp"] [find comment="udp"]
Alternatively, you can use the "get" command (w/ the "find" command), to obtain the internal ID of each of the two firewall rules.
/ip firewall filter move ([/ip firewall filter get [find comment="icmp"]]->".id") ([/ip firewall filter get [find comment="udp"]]->".id")