We currently have 6 open bug reports at <https://bugs.launchpad.net/ubuntu/+source/shim-signed>, and several closed ones, from users who have by one means or another gotten /boot/efi unmounted on their systems and then tried to apply updates.
On a UEFI system, /boot/efi must be a separate mount point (it's the EFI System Partition); and it must be mounted at the time of upgrading the shim-signed/grub-efi-amd64 packages, because it's meaningless to "upgrade" these packages without installing the new bootloader to the ESP - if you don't want to use the Ubuntu UEFI bootloader, uninstall the package.
However, a surprising number of users (i.e., more than 0) are leaving /boot/efi unmounted on their systems, and as a result get upgrade failures. This is a bad thing to have happen in the middle of a dist-upgrade between releases.
I think u-r-u should detect the case where either of the shim-signed and grub-efi-amd64 packages are installed, and /boot/efi is not in a sane state (is mountpoint + is mounted rw), and refuse to let the user start the upgrade until this is resolved.
From the POV of "u-r-u shouldn't be a dumping ground for quirking upgrade issues we can fix in packages", shouldn't this check be in preinsts for the packages that twiddle /boot/efi, not in the upgrader?
Also, can we do better here (like we do with non-mounted bootloader partitions, like PReP) and somehow automatically detect the correct partition and mount it before attempting to use it?