>> Is there a standard HOWTO I can follow to fix the boot process (to go
>> from a grub / xen.cfg that fails to LUKS decrypt and load unencrypted
>> rootfs)
Not that I know. Would be helpful, indeed.
>> Unfortunately the grub update for the kernel upgrade seems to have
>> messed up the boot process. How do I figure out if it's installed for
>> BIOS or UEFI mode ?
That is in your BIOS. If it is "legacy" it means old-school MBR, if not
it should be written UEFI somewhere.
>> My data is safe and LUKS encrypted . I can use a live USB to decrypt it,
>> access it and I also have made 2 backup copies.
good.
>> So with nothing to lose I tried to fix the boot manually from a live USB
>> including creating /etc/default/grub but situation is no better.
I had similar problems recently. If it is UEFI (and I guess so),
efibootmgr is your friend (not preinstalled on debian-live, but you grab
it easily via apt-get). Also look the "UEFI troubleshooting" qubes
webpage! You can re-do the qubes boot entry with efibootmgr (please read
the man page, syntax is not memorisable for me). Good luck, Bernhard