Oli gave a good answer, but wait, mine will be better! :-)
Oli commented on the limited current from the coin cell, and that's indeed something to keep an eye on. This CR2430 cell gives 5 mA as maximum continuous. Let's see if we can manage that.
It's a good thing that you only need one LED on at a time, otherwise I would even consider the coin cell. This looks like a nice LED: typically 15 mcd at 2 mA.
Oli went for a SIPO (Serial-In, Parallel-Out) shift register for the LEDs and a PISO (Parallel-In, Serial Out) for the buttons. That saves you a lot of I/O but costs extra components. Can't we use the I/O of a microcontroller directly? 22 LEDs and 8 buttons is 30 I/Os, no problem, but we can do it a bit cheaper if we multiplex the LEDs in a 4 x 5 matrix. Normally this would decrease the LEDs luminosity by 75 %, but since we only have to light one LED at a time we can select one row and one column statically. So we need 4 + 5 + 8 = 17 I/Os.
Usual suspects for a microcontroller are Atmel AVR and Microchop PIC. Usually I'd avoid PIC for LED driving because it can't source or sink 20 mA, but we have a low LED current so no problem. PIC is also cheaper than AVR. The PIC16F57 has 20 I/Os, so that's enough. The datasheet says 22.5 µA maximum for a 32.768 kHz clock at 2 V, so at 3 V that still will be below 50 µA.
That's it. A microcontroller, a cheap crystal, 22 LEDs, 8 buttons, and 12 resistors (4 for the LEDs and 8 for the buttons. The PIC16F57 doesn't seem to have internal pull-ups). No shift registers needed.
LEDs do not typically have much ability to withstand reverse voltages. In fact, the datasheet you linked to does not even attempt to give these LEDs a rating.
When you connect an LED between a +15V source and a +5V source, you are putting 10V of reverse bias across it, and it isn't surprising that it passes current.
If you want this circuit to work as intended, you need to put a regular signal diode in series with each of your indicator LEDs to block the reverse voltage.
Best Answer
My opinion is that it is safe, and all single LED's use a -5V Vr max spec.
But for leakage, there may be exceptions beyond your requirements due to wounded LED's that leak more than spec, from overstress due to static discharge, solder temperature, operating temperature, moisture ingress and others, which all affect leakage. Also increased chip sizes from 0.1W to 1W to 10W will undoubtedly leak more from total area, but vary from OEM to OEM on specs. I can't speak for all Chinese factories of flashlights to see if they buy LED's that are guaranteed low leakage, 1vs 10 vs 100uA but low leakage is a quality factor to consider qualifying a source of LED's in large volume for reliability reasons. As aging factors, contamination, moisture ingress all affect leakage as well as ESD/EOS.
Using a 1MOhm series resistor you can create a curve-tracer using a scope, signal gen. and xy mode and compare LED leakage specs, if you have a batch and verify as I have done on a sample basis. Solder temp over stress can also affect leakage.
In the end your lithium coin cell leakage when cold may be good for 10 years and when hot maybe only a few years. The reverse connection idea may be adquate, but the flashlight designs I have seen all include a screw cap threaded switch contact or momentary if it is a multi-function flashlight, then use a momentary switch. Then they use a plastic ABS shim in series with the battery with a pull-away tab or removal instructions for shipment to avoid power activation during shipment.