Hi Andrei,
thanks for your reply. I tried both /dev/sda and /dev/sda2. I ended up
solving the problem by making a total of three partitions: A small one
for EFI, another one for /boot, and the encrypted main partition. Small
snag was that the Debian installer cannot be persuaded to install the
grub EFI into the EFI partition on the mobile disk but on the one in the
built-in disk. But that was easily fixed by by mounting the mobile EFI
partition, correcting /sys/fstab and re-installing grub and kernel.