Any objections to something like an ioctl (fd, FIFREEZETHAW, 0) ?

It's going to be completely trivial, which argues for it.  The only
points left woul be bikeshedding over the name, and how to describe
its semantics.

in the end probably the real fix is probably something like storing
multiple copies of the bootloader config with checksums that grub
can verify.  Basically teach grub to try really hard to extract known-good
data from the FS.  For file-level consistency that'd be pretty easy,
we could have e.g. 

The real answer is to have a filesystem that does the above for you
for the boot partition, e.g. one where the kernel and grub have
a common consistency protocol for.