Then did a stack export, removed the offending security group, imported (success), but then got a panic on the next refresh: