Add a byte to the grub config block (wherever setdefault gets
indicating whether a boot was clean or not. Have grub set clear that at
kernel load, and then have a userspace app that sets it at the
completion of boot. Check whether it's set or not on next boot and use
that to run a different config stanza.
With this in mind, I'm sending the following patch for grub2 upstream. It
implements something analogous to this for UEFI systems. With this, a
change to how we generate grub2 configuration files (just adding a call),
and small amount of userland hacking, we can effectively cause the bootloader
to use a large timeout when the previous boot has failed.