No cases where a warrant canary was removed to signal the possible receipt of an NSL have been prosecuted. Either all those warrant canaries were removed for other reasons, or prior restraint is still unconstitutional enough to keep prosecutors at bay.
At the time of posting, no security letter has been received. So it cannot violate a non-existent letter. If you assume that the letter could preclude you from removing the warrant, you just need a living canary. You post a new canary every day that you haven't received one. If it goes stale, you must have received a letter. There is no way that they can compel you to lie to the public and post a new canary after the letter.
Suppose you get an email from the boss saying, "singlow, remove the warrant canary script from cron. I just got out of a meeting with the Board, and they all agreed we need to inform the public that we've received this national security letter."
If you truly believe your argument, you wouldn't prosecute the boss even in the presence of this email. We all know anyone planning on using a warrant canary is intending to inform the public, so whether or not there's an email admitting it should be irrelevant if the action is legal. If you believe that the boss is not guilty, then you're consistent in your position.
Now, as a practical matter, you'd use an in-person meeting or telephone call or something. Or you'd at least use different wording. But the act itself would in principle still be illegal, even though there is no evidence to prosecute. And in that sense, a warrant canary could be a useful tool to allow one to get away with a crime that they consider unjust.