Try install-grub instead.
The shim lock problem is caused by the fact that /boot/efi/EFI/bootx64.efi and /boot/efi/EFI/manjaro/grubx64.efi are different from one another. install-grub is a script meant to synchronize the two files, so that they will be identical again. It comes with a pacman hook too, so that it automatically runs after an update.