Thanks @freggel.doe. Yes, update-grub is not installed yet, so I’ll have to risk the update. I’ll try doing so in a few days, after I’ve backed up my data.
Given the downsides of ignoring packages, I just applied philm’s workaround and unignored grub before updating, which fixed the issue without reactivating the previous LUKS encrypted install issue. Thanks @freggel.doe!