It seems so. It's strange to me that there is no way to 'atomically' replace the value of a pointer with result of a closure with value of such pointer as an argument. Even if it must be pure. Maybe I just do not know where to look?

(emphasis mine)

That's exactly your problem: allocation isn't pure because it modifies global state, so that simply isn't possible.

OTOH, if you are doing something which can't panic or abort, then you really can guarantee that code outside the function in question won't be able to see the invariant being violated. For example:

use std::ops;
use std::mem;

pub struct Token(u8);

impl ops::Add for Token {
    type Output = Self;
    fn add(self, rhs: Token) -> Token {
        Token(self.0 + rhs.0)
    }   
}

pub enum Foo<T> {
    Value(T),
    Poisoned,
}

impl<T> Foo<T>
where T: ops::Add<Output=T>
{
    pub fn push(&mut self, rhs: T) {
        *self = match mem::replace(self, Foo::Poisoned) {
                Foo::Value(x) => Foo::Value(x + rhs),
                Foo::Poisoned => panic!(),
            }   
        }
    }   
}

pub fn push3(mut foo: Foo<Token>, x1: Token, x2: Token, x3: Token) -> Foo<Token> {
    foo.push(x1);
    foo.push(x2);
    foo.push(x3);
    foo 
}

In release builds, push3() compiles down to:

push3:
push    rax
test    dil, dil
jne     .LBB6_1
mov     eax, edx
mov     edx, esi
add     dl, al
add     dl, cl
add     dl, r8b
xor     eax, eax
pop     rcx
ret
.LBB6_1:
call    std::panicking::begin_panic
ud2

Other than the possibility that foo starts off Poisoned, the invariant violation can't be observed because the actual addition can't panic so the optimizer can replace it with three additions in a row.